{"id":"CVE-2014-2322","aliases":["EUVD-2017-0250","GHSA-hgmw-x865-hf9x"],"status":"published","title":"Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters","description":"lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02188,"percentile":0.82534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2014-05-02T14:00:00Z","modified":"2026-06-17T00:06:24Z","affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"arabic-prawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"Arabic-Prawn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.0.1"}]}],"versions":["0.0.1"]}],"products":[{"vendor":"dynamixsolutions","product":"arabic_prawn"}],"references":[{"url":"http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/10/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/03/12/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2322","tags":["advisory"]},{"url":"https://web.archive.org/web/20160306235714/http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hgmw-x865-hf9x"},{"url":"https://github.com/ozeron/prawn-arabic","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2014-2322","description":"lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","status":"published","published":"2014-05-02T14:00:00Z","modified":"2024-08-06T10:06:00.48Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2017-0250","description":"lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","status":"published","published":"2014-05-02T14:00:00Z","modified":"2024-08-06T10:06:00Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-hgmw-x865-hf9x","title":"Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters","description":"`lib/string_utf_support.rb` in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-05T05:03:19Z","updated_at":"2026-11-02T14:37:13.301199Z"}],"nvd":[{"id":"CVE-2014-2322","description":"lib/string_utf_support.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","status":"published","published":"2014-05-02T14:55:07.217Z","modified":"2026-06-17T00:06:24.467Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:54.082915Z"}],"osv":[{"id":"GHSA-hgmw-x865-hf9x","title":"Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters","description":"`lib/string_utf_support.rb` in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) downloaded_file or (2) url variable.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-12-04T05:38:36.327761Z","updated_at":"2026-11-02T15:46:49.28217Z"}]}}