Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE. The manipulate! method inappropriately evals the content of mutation option :read/ :write, allowing attackers to craft a string that can be executed. If an application developer supplies untrusted inputs to th...

Mshibuya CarrierWave Code Code Injection Vulnerability

Mshibuya CarrierWave is an upload tool from the Mshibuya Personal Organization in the United States. It provides a simple and extremely flexible way to upload files from Ruby applications. A code injection vulnerability exists in Mshibuya CarrierWave versions 1.3.2 and prior to 2.1.1, which stems...

CVE-2021-21305: Improper Neutralization of Special Elements in Output Used by a Downstream Component

CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1, there is a code injection vulnerability. The "manipulate!" method inappropriately evals the content of mutation option:read/:write...