High severityNVD Advisory· Published Dec 12, 2013· Updated Jun 17, 2026
CVE-2013-6421
CVE-2013-6421
Description
The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- cpe:2.3:a:projectsprouts:sprout:0.7.246:-:-:*:-:ruby:*:*
- ghsa-coords
Patches
Vulnerability mechanics
References
7- vapid.dhs.org/advisories/sprout-0.7.246-command-inj.htmlnvdExploitWEB
- www.openwall.com/lists/oss-security/2013/12/03/1nvdExploitWEB
- www.openwall.com/lists/oss-security/2013/12/03/6nvdExploitWEB
- github.com/advisories/GHSA-229r-pqp6-8w6gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-6421ghsaADVISORY
- archives.neohapsis.com/archives/bugtraq/2013-12/0077.htmlnvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/sprout/CVE-2013-6421.ymlghsaWEB
News mentions
0No linked articles in our index yet.