-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper sanitization of string-type parameter keys during command line construction. The original build_command_line relied on sanitize_key, which only processed Symbol keys, leaving user-controlled string keys vulnerable to injection. The patch moved this logic to a dedicated class but crucially addressed the lack of key sanitization for non-Symbol inputs. The pre-1.2.0 code allowed attackers to inject commands via unescaped string keys, as demonstrated by the test case removal in the spec files and the advisory example using {:params => {'-l' => ";touch haxored"}}.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| awesome_spawn | rubygems | < 1.2.0 | 1.2.0 |