-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unsanitized 'content_type' input being passed to external commands via HookManager. The patch adds Shellwords.escape validation to @content_type in Attachment#initialize, confirming this was the injection point. The commit message and diff show the vulnerable code path involved in processing email attachments' content_type.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sup | rubygems | < 0.13.2.1 | 0.13.2.1 |
| sup | rubygems | >= 0.14.0, < 0.14.1.1 | 0.14.1.1 |
A Semantic Attack on Google Gemini - Read the Latest Research