Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2013-4318: Malicious code can be injected into the /tmp directory via Ruby gem Features
CVE-2013-4318 · published 6 years ago
Summary
A security issue exists in the Features Ruby gem, which could allow an attacker to inject malicious code into the /tmp directory. This could potentially lead to unauthorized actions on your system. If you are using the Features gem, it is recommended to update to a patched version.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | matthias hennemeyer | features | <= 0.3.0 |
| – | feature_project | feature |
0.3.0 cpe:2.3:a:feature_project:feature:0.3.0:*:*:*:*:ruby:*:* |
Original advisory text
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.
File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the /tmp directory.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-74Injection
Timeline
Published26 Dec 2019
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta