Lucene search
+L

25601 matches found

Github Security Blog
Github Security Blog
•added 2026/11/03 5:51 p.m.•1 views

Elo Ruby backend has Remote Code Execution via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the character. Because begins Ruby's interpolation sequences — expr, @ivar, @@cvar, $gvar — and any expression wrapped in ... may use backticks for shell execution, an Elo program that...

9.8CVSS
SaveExploits0References4Affected Software1
Rows per page
Query Builder