The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available.
Command Injection
Creme Fraiche
NVD
CVSS 2.0
9.3
EPSS
1.4%