debian/ruby-diffy vulnerabilities

Latest debian/ruby-diffy CVEs

Newest publication first

1. CVE-2022-33127 Improper handling of double quotes in file name in Diffy in Windows environment

   Critical·CVSS 9.8 EPSS 1.8% PoC

   The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.