{"id":"CVE-2013-1947","aliases":["EUVD-2017-0184","GHSA-78j3-7wpm-qhvp"],"status":"published","title":"Shell Metacharacter Injection in kelredd-pruview","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01605,"percentile":0.7602,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2013-04-25T23:00:00Z","modified":"2026-06-16T23:52:27Z","affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"kelredd-pruview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.5.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"kelredd-pruview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.5.0"}]}],"versions":["0.1.1","0.1.10","0.1.11","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.1.9","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.4.0","0.4.1","0.5.0"]}],"products":[{"vendor":"kelly_d._redding","product":"kelredd-pruview"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/04/10/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1947","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-78j3-7wpm-qhvp","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/kelredd-pruview/CVE-2013-1947.yml","tags":["web"]},{"url":"http://vapid.dhs.org/advisories/kelredd-pruview-cmd-inject.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-1947","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-09-16T18:19:38.111Z","updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2017-0184","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.","status":"published","published":"2013-04-25T23:00:00Z","modified":"2024-09-16T18:19:38Z","updated_at":"2026-11-03T00:55:33.363823Z"}],"ghsa":[{"id":"GHSA-78j3-7wpm-qhvp","title":"Shell Metacharacter Injection in kelredd-pruview","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or video_image.rb.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-07-05T19:12:36Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2013-1947","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.","status":"published","published":"2013-04-25T23:55:01.597Z","modified":"2026-06-16T23:52:27.34Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:02:25.704053Z"}],"osv":[{"id":"GHSA-78j3-7wpm-qhvp","title":"Shell Metacharacter Injection in kelredd-pruview","description":"kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to document.rb, video.rb, or video_image.rb.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-08T05:34:00.288112Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:40.657155Z"}]}}