gollum and gollum-lib allow remote authenticated users to execute arbitrary code

2017-11-1601:47:37

Google

osv.dev

0.005 Low

EPSS

Percentile

75.8%

JSON

The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string master is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.

CPENameOperatorVersion
gollumeq2.3.3
gollumeq1.3.0
gollumeq1.4.3
gollum-libeq1.0.3
gollumeq1.1.1
gollum-libeq1.0.8
gollumeq2.4.12
gollumeq2.4.8
gollumeq2.4.2
gollumeq2.2.0