Description

amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-13T14:17:11.440Z",
  "pubdate": "2026-08-13T14:17:11.440Z",
  "executiveSummary": "A Ruby code injection vulnerability exists in amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 within the AwesomeMethodArray#grep component. The flaw allows an attacker to achieve arbitrary Ruby code execution within the host process under specific conditions. The vulnerability type is code injection, which severely impacts the confidentiality, integrity, and availability of the affected system by allowing full execution of arbitrary code.\nThe affected product is amazing-print/amazing_print. Risk implications are high as successful exploitation leads to complete compromise of the host process executing the application. Attacker capabilities include executing arbitrary system commands or Ruby code depending on the privileges of the host process. Exploitation requires an application path that specifically allows an attacker to influence dynamic method names processed by the vulnerable grep method.",
  "technicalDetails": "The root cause of the vulnerability resides in the AwesomeMethodArray#grep method within amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234. The vulnerable component dynamically constructs strings intended for execution via eval without proper sanitization or neutralization of user-supplied input.\nSpecifically, when grep is called with a block, a specially named method containing Ruby interpolation syntax (such as string interpolation sequences like # {}) can be introduced. Because the method name is inadequately handled and subsequently interpolated directly into a dynamically constructed eval string, the embedded Ruby interpolation syntax is evaluated and executed by the Ruby interpreter.\nThe step-by-step attack flow proceeds as follows: First, an attacker identifies or interacts with an application path where user input can directly influence or define dynamic method names processed by amazing_print. Second, the attacker crafts a malicious method name incorporating targeted Ruby interpolation syntax or payloads designed to execute arbitrary code. Third, the application invokes AwesomeMethodArray#grep with a block, causing the vulnerable component to construct an eval string containing the malicious method name. Fourth, the dynamic evaluation executes the embedded payload, resulting in arbitrary Ruby code execution within the context of the host process.\nThe vulnerability requires local application context where dynamic method names can be influenced; network exposure depends entirely on the hosting application architecture. No specific authentication or privilege requirements are mandated by the vulnerability itself beyond the ability to supply the malicious method name via the application interface. Post-exploitation impact includes arbitrary code execution, potential data exfiltration, system command execution, and complete application takeover depending on the execution context."
}