Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution. Type confusion exists in canceleval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitrary code execution. Remediation There is no fixed...