Loading...
Skip to main content
GeekWala

GHSA-q95h-cqrv-8jv5 — Vulnerability in exiftool_vendored —...

HIGH

ExifTool vulnerable to arbitrary code execution

Published January 20, 2023Updated November 29, 2024Source: osv

Summary

### Impact Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads ### Patches ExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0). ### Workarounds No ### References https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 ### For more information If you have any questions or comments about this advisory: Open an issue in [exiftool_vendored.rb](https://github.com/exiftool-rb/exiftool_vendored.rb/issues)

Advisory Timeline

  • First published January 20, 2023 (1361 days ago).
  • Last revised November 29, 2024 — 678 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update exiftool_vendored to 12.25.0 or later
gem install exiftool_vendored -v 12.25.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
exiftool_vendored
rubygems
10.01.0, 10.04.0, 10.23.0, 10.25.0 (+94 more)12.25.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.8 score means for each attack dimension.

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is GHSA-q95h-cqrv-8jv5?
ExifTool vulnerable to arbitrary code execution This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.8/10).
How do I check if my project is affected by GHSA-q95h-cqrv-8jv5?
GHSA-q95h-cqrv-8jv5 affects exiftool_vendored. Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-q95h-cqrv-8jv5 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.8

High exploitability or significant impact. Prioritize remediation within days.

Related CVEs

  • CVE-2026-94462
    HIGH

    Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

  • CVE-2026-77601
    HIGH

    OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies