Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

discordrb

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.6RubyGemsPublished

    discordrb OS Command Injection vulnerability

    CVE-2023-28102 · GHSA-8832-4mm5-x2r6

    Affected
    • RubyGems discordrb < 3.4.3
    Fixed in
    3.4.3· Vendor fix available
    Issue
    discordrb is an implementation of the Discord API using Ruby. In discordrb before commit 91e13043ffa the encoder.rb file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the discordrb library and will likely not be total system access. This issue has been addressed in code, but a new release of the discordrb gem has not been uploaded to rubygems. This issue is also tracked as GHSL-2022-094.

    Recommended action: Upgrade to 3.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →