-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| diffy | rubygems | < 3.4.1 | 3.4.1 |
RubyRubyMiggo AIRoot Cause AnalysisThe vulnerability stemmed from the Windows-specific code path in Diff::Diff#diff that constructed a command string using sprintf with user-controlled filenames wrapped in quotes. This approach used shell execution (via backticks) which doesn't properly handle argument escaping, allowing attackers to break out of the filename quoting and inject commands. The patch replaced this with Open3.capture3 which safely passes arguments without shell interpolation. The commit diff clearly shows removal of the vulnerable Windows-specific code block, confirming this was the attack vector.
Ongoing coverage of React2Shell