CVE-2017-0899
CriticalSummary
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification could execute terminal escape sequences.
Risk Assessment
An attacker could exploit this vulnerability to execute unauthorized commands in the terminal, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade RubyGems to version 2.6.13 or later to mitigate this vulnerability.
Other vulnerabilities in RubyGems
See all- CVE-2017-0902High
RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
- CVE-2017-0901High
RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
- CVE-2017-0900High
RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.
- CVE-2017-0903Critical
RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.
- CVE-2026-82455Low risk· EPSS 4%
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe.
Original NVD description (English source)
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.