deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: awesome-bot (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: blockchain_wallet (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: coin_base (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 0
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: cron_parser (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 0.1.4
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: cron_parser (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.0.13, <= 1.0.14
Patched in: unpatched

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-333g-rpr4-7hxq
Package: rest-client (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.6.10, <= 1.6.13
Patched in: 1.7.0

Summary: rest-client Gem Contains Malicious Code

Details:
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
GitHub Security Advisory: GHSA-r23g-3qw4-gfh2
Package: redcloth (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.3.0
Patched in: 4.3.0

Summary: RedCloth Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a `javascript:` URI.
GitHub Security Advisory: GHSA-c5r5-7pfh-6qg6
Package: bibtex-ruby (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 5.0.1
Patched in: 5.1.0

Summary: BibTeX-Ruby vulnerable to OS command injection

Details:
BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby `Kernel.open` method through BibTeX.open.
GitHub Security Advisory: GHSA-9h36-4jf2-hx53
Package: extlib (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: < 0.9.16
Patched in: 0.9.16

Summary: extlib does not properly restrict casts of string values

Details:
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GitHub Security Advisory: GHSA-m7fq-cf8q-35q7
Package: crack (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: < 0.3.2
Patched in: 0.3.2

Summary: crack does not properly restrict casts of string values

Details:
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
GitHub Security Advisory: GHSA-cpjc-p7fc-j9xh
Package: mail (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.2.15
Patched in: 2.2.15

Summary: Mail Improper Input Validation vulnerability

Details:
The deliver function in the sendmail delivery agent (`lib/mail/network/delivery_methods/sendmail.rb`) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address.
GitHub Security Advisory: GHSA-vm28-mrm7-fpjq
Package: sfpagent (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: < 0.4.15
Patched in: 0.4.15

Summary: sfpagent Command Injection vulnerability

Details:
`lib/sfpagent/bsig.rb` in the sfpagent gem before 0.4.15 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the module name in a JSON request.
GitHub Security Advisory: GHSA-ww79-8xwv-932x
Package: rbovirt (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: < 0.0.24
Patched in: 0.0.24

Summary: rbovirt uses the rest-client gem with SSL verification disabled

Details:
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
GitHub Security Advisory: GHSA-cr5j-953j-xw5p
Package: rexical (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.0.7
Patched in: 1.0.7

Summary: Nokogiri Command Injection Vulnerability

Details:
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
GitHub Security Advisory: GHSA-cr5j-953j-xw5p
Package: nokogiri (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.10.4
Patched in: 1.10.4

Summary: Nokogiri Command Injection Vulnerability

Details:
A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
GitHub Security Advisory: GHSA-mqm2-cgpr-p4m6
Package: kramdown (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 2.3.0
Patched in: 2.3.0

Summary: Unintended read access in kramdown gem

Details:
The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
GitHub Security Advisory: GHSA-hxqx-xwvh-44m2
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.2, <= 2.2.3.0
Patched in: 2.2.3.1

Summary: Denial of Service Vulnerability in Rack Multipart Parsing

Details:
There is a possible denial of service vulnerability in the multipart parsing component of Rack.  This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected:  >= 1.2
Not affected:       < 1.2
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts.  This includes directly using the multipart parser like this:

```
params = Rack::Multipart.parse_multipart(env)
```

But it also includes reading POST data from a Rack request object like this:

```
p request.POST # read POST data
p request.params # reads both query params and POST data
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds
There are no feasible workarounds for this issue.
GitHub Security Advisory: GHSA-hxqx-xwvh-44m2
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 2.1, <= 2.1.4.0
Patched in: 2.1.4.1

Summary: Denial of Service Vulnerability in Rack Multipart Parsing

Details:
There is a possible denial of service vulnerability in the multipart parsing component of Rack.  This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected:  >= 1.2
Not affected:       < 1.2
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts.  This includes directly using the multipart parser like this:

```
params = Rack::Multipart.parse_multipart(env)
```

But it also includes reading POST data from a Rack request object like this:

```
p request.POST # read POST data
p request.params # reads both query params and POST data
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds
There are no feasible workarounds for this issue.
GitHub Security Advisory: GHSA-hxqx-xwvh-44m2
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 1.2, <= 2.0.9.0
Patched in: 2.0.9.1

Summary: Denial of Service Vulnerability in Rack Multipart Parsing

Details:
There is a possible denial of service vulnerability in the multipart parsing component of Rack.  This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected:  >= 1.2
Not affected:       < 1.2
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts.  This includes directly using the multipart parser like this:

```
params = Rack::Multipart.parse_multipart(env)
```

But it also includes reading POST data from a Rack request object like this:

```
p request.POST # read POST data
p request.params # reads both query params and POST data
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds
There are no feasible workarounds for this issue.
GitHub Security Advisory: GHSA-jw9f-hh49-cvp9
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 8.6)
CWE: CWE-787: Out-of-bounds Write
Vulnerable versions: < 1.11.4
Patched in: 1.11.4

Summary: Nokogiri contains libxml Out-of-bounds Write vulnerability

Details:
There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.
GitHub Security Advisory: GHSA-7fqj-cg79-f2pv
Package: thumbshooter (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 0.1.5
Patched in: unpatched

Summary: Thumbshooter vulnerable to Code Injection

Details:
lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
GitHub Security Advisory: GHSA-w248-xr37-jx8m
Package: fastreader (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.0.0
Patched in: unpatched

Summary: fastreader Gem for Ruby URI Handling Arbitrary Command Injection

Details:
fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands.
GitHub Security Advisory: GHSA-67j6-xv27-w6ww
Package: web-console (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 2.1.3
Patched in: 2.1.3

Summary: Web Console (Ruby gem) contains whitelisted_ips bypass

Details:
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
GitHub Security Advisory: GHSA-5h5r-ffc4-c455
Package: strong_password (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 0.0.7
Patched in: 0.0.8

Summary: strong_password Ruby gem malicious version causing Remote Code Execution vulnerability

Details:
The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Version 0.0.8 does not contain the backdoor.
GitHub Security Advisory: GHSA-wmjf-jpjj-9f3j
Package: rubocop (RUBYGEMS)
Severity: LOW (CVSS 3.3)
CWE: CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: < 0.49.0
Patched in: 0.49.0

Summary: RuboCop gem Insecure use of /tmp

Details:
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
GitHub Security Advisory: GHSA-gx5g-xcxj-cx2w
Package: smart_proxy_dynflow (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-287: Improper Authentication
Vulnerable versions: < 0.1.11
Patched in: 0.1.11

Summary: smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature

Details:
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
GitHub Security Advisory: GHSA-gx5g-xcxj-cx2w
Package: smart_proxy_dynflow (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-287: Improper Authentication
Vulnerable versions: = 0.2.0
Patched in: 0.2.1

Summary: smart_proxy_dynflow gem authentication bypass in Foreman remote execution feature

Details:
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
GitHub Security Advisory: GHSA-wg6j-r28m-7293
Package: simple_captcha2 (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: = 0.2.3
Patched in: unpatched

Summary: Code backdoor in simple_captcha2

Details:
The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
GitHub Security Advisory: GHSA-3h4r-pjv6-cph9
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: RubyGems Escape sequence injection vulnerability in api response handling

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
GitHub Security Advisory: GHSA-3h4r-pjv6-cph9
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.6.0, < 2.7.9
Patched in: 2.7.9

Summary: RubyGems Escape sequence injection vulnerability in api response handling

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.
GitHub Security Advisory: GHSA-mh37-8c3g-3fgc
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: RubyGems Escape sequence injection vulnerability in gem owner

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
GitHub Security Advisory: GHSA-mh37-8c3g-3fgc
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 2.6.0, < 2.7.9
Patched in: 2.7.9

Summary: RubyGems Escape sequence injection vulnerability in gem owner

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
GitHub Security Advisory: GHSA-fr32-gr5c-xq5c
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: RubyGems Escape sequence injection vulnerability in verbose

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
GitHub Security Advisory: GHSA-fr32-gr5c-xq5c
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: >= 2.6.0, < 2.7.9
Patched in: 2.7.9

Summary: RubyGems Escape sequence injection vulnerability in verbose

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
GitHub Security Advisory: GHSA-4wm8-fjv7-j774
Package: rubygems-update (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Vulnerable versions: >= 3.0.0, < 3.0.2
Patched in: 3.0.2

Summary: RubyGems Escape sequence injection in errors

Details:
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)