CVE-2019-16255

Name of the Vulnerable Software and Affected Versions Ruby versions 2.4.7 and earlier, 2.5.x through 2.5.6, and 2.6.x through 2.6.4

Description The issue allows code injection if the first argument to Shell#[] or Shell#test in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method. This is due to incorrect neutralization of special elements in output used by an incoming component.

Recommendations For Ruby versions 2.4.7 and earlier, update to version 2.4.8. For Ruby versions 2.5.x through 2.5.6, update to version 2.5.7. For Ruby versions 2.6.x through 2.6.4, update to version 2.6.5. As a temporary workaround, consider validating and sanitizing the first argument to Shell#[] and Shell#test to prevent code injection.