The vulnerability of the _cancel_eval method in the TclTkIp class of the Ruby interpreter allows a hacker to execute arbitrary code.

The vulnerability of the canceleval method in the TclTkIp class of the Ruby interpreter arises from an incorrect check of the returned value by the method or function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution. Remediation There is no fixed...