CVE-2018-3779: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

August 13, 2018 (updated January 8, 2021)

active-support ruby gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.

References

github.com/advisories/GHSA-2j55-pcw5-x4h2
hackerone.com/reports/392311
nvd.nist.gov/vuln/detail/CVE-2018-3779

Code Behaviors & Features

Detect and mitigate CVE-2018-3779 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →