CVE-2017-0899

Critical

Published: 31/08/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.

Risk Assessment

An attacker could exploit this vulnerability to execute unauthorized commands in the terminal, potentially leading to serious security breaches.

Recommendation

It is recommended to upgrade RubyGems to version 2.6.13 or later to mitigate this vulnerability.

Original NVD description (English source)

RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.