RubyFlow The Ruby and Rails community linklog

×

The Ruby and Rails community linklog

Made a library? Written a blog post? Found a useful tutorial? Share it with the Ruby community here or just enjoy what everyone else has found!

How I found two command injections in the spatial_features Ruby gem

by Saïd M. —

While using the spatial_features Ruby gem for a side project, I noticed that filenames were being passed to system. It led me to two command injection paths, fixed in version 3.11.2. Here’s how I found them, built the PoC, and reported the issue: https://base16.fr/en/blog/command-injection-spatial-features

Post a comment

You can use basic HTML markup (e.g. <a>) or Markdown.

As you are not logged in, you will be
directed via GitHub to signup or sign in