VYPR
← All advisories
Critical severity10.0NVD Advisory· Published Jan 8, 2016· Updated May 6, 2026

CVE-2015-7541

CVE-2015-7541

Description

The initialize method in the Histogram class in lib/colorscore/histogram.rb in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) image_path, (2) colors, or (3) depth variable.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
colorscoreRubyGems
< 0.0.50.0.5

Affected products

1

Patches

1
570b5e854cec

Fix CVE-2015-7541

https://github.com/quadule/colorscoreFlorian FrankJan 5, 2016via ghsa
commit
1 file changed · +3 −1
  • lib/colorscore/histogram.rb+3 −1 modified
    @@ -1,7 +1,9 @@
+require "shellwords"
+
 module Colorscore
   class Histogram
     def initialize(image_path, colors=16, depth=8)
-      output = `convert #{image_path} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors} -depth #{depth} histogram:info:-`
+      output = `convert #{image_path.shellescape} -resize 400x400 -format %c -dither None -quantize YIQ -colors #{colors.to_i} -depth #{depth.to_i} histogram:info:-`
       @lines = output.lines.sort.reverse.map(&:strip).reject(&:empty?)
     end

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.