rdoc 6.1.0
RDoc OS command injection vulnerability
high severity CVE-2021-31799~> 6.1.2.1, ~> 6.2.1.1, >= 6.3.1
< 3.11.0
RDoc used to call Kernel#open to open a local file. If a Ruby project has
a file whose name starts with | and ends with tags, the command following
the pipe character is executed. A malicious Ruby project could exploit it to
run an arbitrary command execution against a user who attempts to run rdoc
command.
RCE vulnerability with .rdoc_options in RDoc
medium severity CVE-2024-27281~> 6.3.4, >= 6.3.4.1, ~> 6.4.1, >= 6.4.1.1, >= 6.5.1.1
An issue was discovered in RDoc 6.3.3 through 6.6.2, as distributed in Ruby 3.x through 3.3.0.
When parsing .rdoc_options (used for configuration in RDoc) as a YAML file,
object injection and resultant remote code execution are possible because
there are no restrictions on the classes that can be restored.
When loading the documentation cache, object injection and resultant remote code execution are also possible if there were a crafted cache.
We recommend to update the RDoc gem to version 6.6.3.1 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:
- For Ruby 3.0 users: Update to
rdoc6.3.4.1 - For Ruby 3.1 users: Update to
rdoc6.4.1.1 - For Ruby 3.2 users: Update to
rdoc6.5.1.1
You can use gem update rdoc to update it. If you are using bundler, please
add gem "rdoc", ">= 6.6.3.1" to your Gemfile.
Note: 6.3.4, 6.4.1, 6.5.1 and 6.6.3 have a incorrect fix. We recommend to upgrade 6.3.4.1, 6.4.1.1, 6.5.1.1 and 6.6.3.1 instead of them.
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.