PT-2026-103958
CVE-2026-12545
·
تاريخ النشر
2026-10-01
·
تاريخ التحديث
2026-10-07
الوصف من
CVSS 3.1
6.7
متوسطةالمقاييسAV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
rubygem-hammer cli (affected versions not specified)
Description
Command injection is possible in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite. The issue occurs because the
$EDITOR environment variable is insecurely interpolated into the Ruby system() function. When a single interpolated string is passed to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters such as ;, |, and &.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾