EUVD-2026-58030
GHSA-4fc2-r6x5-wm8p
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N reflects realistic web-application exposure; AC:H captures the specific non-default application code path required; PR:N since no authentication is required once that path is reachable.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.
AnalysisAI
Ruby code injection in the amazing_print gem's AwesomeMethodArray#grep enables arbitrary Ruby code execution inside the host process when attacker-controlled strings containing interpolation syntax reach a dynamically constructed eval call. Specifically pinned to commit dc890dfafdf07088ea901df53c19c2710e5c5234, the flaw requires an application code path where externally influenced values can become method names processed by grep with a block. A publicly available proof-of-concept exists on GitHub Gist, and while the CVE is not in CISA KEV, the full-RCE impact in affected deployments warrants urgent remediation review.
Technical ContextAI
amazing_print is a Ruby gem providing enhanced pretty-printing and object introspection, including method listing via the AwesomeMethodArray class. The vulnerable code resides in lib/amazing_print/core_ext/awesome_method_array.rb at line 71, where a string passed to eval is constructed dynamically by incorporating method names without sanitizing Ruby interpolation metacharacters. CWE-94 (Improper Control of Generation of Code - Code Injection) precisely characterizes this root cause: when grep is invoked with a block, a method name that contains a Ruby interpolation sequence such as #{...} is expanded inside the eval expression rather than treated as a literal string, causing the interpolated content to execute as Ruby code in the host process. The CPE string (cpe:2.3:a:n/a:n/a) supplied by NVD is non-informative and does not clarify the affected gem version range; the vulnerability is anchored specifically to the referenced commit in the upstream GitHub repository.
RemediationAI
Monitor the upstream repository at https://github.com/amazing-print/amazing_print for a tagged release or commit that sanitizes method names before interpolation into the eval string in AwesomeMethodArray#grep, or replaces the eval-based approach entirely - no specific patched gem version is confirmed by any available intelligence source. As an immediate compensating control, audit all application code paths to determine whether externally supplied values can reach amazing_print's method introspection functions; where such paths exist, reject or sanitize any method name string containing the sequence #{ before it enters the library. The most impactful mitigation with no functional trade-off for most deployments is to restrict amazing_print to the :development and :test groups in the application Gemfile, preventing the gem from loading in production environments entirely; since amazing_print is a debugging and pretty-printing utility, its presence in production Gemfiles is itself non-standard and this change carries negligible risk of regressions. Continue checking https://nvd.nist.gov/vuln/detail/CVE-2026-67986 for vendor patch confirmation and an official fix version.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-94 – Code Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today