CVE-2013-1948
md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Exploit likelihood
What each source reports
NVD Score used
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
- Record
CVE-2013-1948- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
- Record
CVE-2013-1948- Updated
- 2026-11-02
EUVDEUVD-2017-0201 No score
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
- Record
EUVD-2017-0201- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99ch-8mvp-g7m5 No score
md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
- Record
GHSA-99ch-8mvp-g7m5- Updated
- 2026-11-02
OSVGHSA-99ch-8mvp-g7m5 No score
md2pdf allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
- Record
GHSA-99ch-8mvp-g7m5- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
md2pdfRubyGems |
through 0.0.1 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1948 is a high vulnerability (CVSS 10.0) in Rob Westgeest Md2pdf, published April 25, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. No source names a fixed version.
References
vapid.dhs.org/advisories/md2pdf-remote-exec.html
osvdb.org/92290
exchange.xforce.ibmcloud.com/vulnerabilities/83416
securityfocus.com/bid/59061
nvd.nist.gov/vuln/detail/CVE-2013-1948
github.com/rubysec/ruby-advisory-db/blob/master/gems/md2pdf/CVE-2013-1948.yml
web.archive.org/web/20130503194109/http://www.securityfocus.com/bid/59061