CVE-2026-67986
HighCVSS 8.4Summary
The amazing_print library (commit dc890df) contains a Ruby code injection vulnerability in the AwesomeMethodArray#grep method. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.
Risk Assessment
The risk to the organization includes remote code execution in the host process, which could lead to full system or application compromise. However, the attack requires specific conditions, such as the ability to influence method names.
Recommendation
It is recommended to immediately update the amazing_print library to a patched version. Also, review application code for paths that allow influencing dynamic method names and restrict such paths.
Original NVD description (English source)
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.