VulnerableCode Package Details - pkg:gem/turbo

Search for packages

Vulnerability	Summary	Fixed by
VCID-kza3-e4r2-zba9 Aliases: CVE-2024-28181 GHSA-mp76-7w5v-pr75	TurboBoost Commands vulnerable to arbitrary method invocation ### Impact TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. #### Details Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. ### Patches Patched in the following versions. - 0.1.3 - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.1.3) - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.1.3) - 0.2.2 - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.2.2) - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.2.2) ### Workarounds You can add this guard to mitigate the issue if running an unpatched version of the library. ```ruby class ApplicationCommand < TurboBoost::Commands::Command before_command do method_name = params[:name].include?("#") ? params[:name].split("#").last : :perform ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1] allowed = ancestors.any? { \|a\| a.public_instance_methods(false).any? method_name.to_sym } throw :abort unless allowed # ← blocks invocation # raise "Invalid Command" unless allowed # ← blocks invocation end end ```	0.2.2 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-kza3-e4r2-zba9
Aliases:
CVE-2024-28181
GHSA-mp76-7w5v-pr75

TurboBoost Commands vulnerable to arbitrary method invocation ### Impact TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing checks aren't as robust as they should be. It's possible for a sophisticated attacker to invoke more methods than should be permitted depending on the the strictness of authorization checks that individual applications enforce. Being able to call some of these methods can have security implications. #### Details Commands verify that the class must be a `Command` and that the method requested is defined as a public method; however, this isn't robust enough to guard against all unwanted code execution. The library should more strictly enforce which methods are considered safe before allowing them to be executed. ### Patches Patched in the following versions. - 0.1.3 - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.1.3) - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.1.3) - 0.2.2 - [NPM Package](https://www.npmjs.com/package/@turbo-boost/commands/v/0.2.2) - [Ruby GEM](https://rubygems.org/gems/turbo_boost-commands/versions/0.2.2) ### Workarounds You can add this guard to mitigate the issue if running an unpatched version of the library. ```ruby class ApplicationCommand < TurboBoost::Commands::Command before_command do method_name = params[:name].include?("#") ? params[:name].split("#").last : :perform ancestors = self.class.ancestors[0..self.class.ancestors.index(TurboBoost::Commands::Command) - 1] allowed = ancestors.any? { |a| a.public_instance_methods(false).any? method_name.to_sym } throw :abort unless allowed # ← blocks invocation # raise "Invalid Command" unless allowed # ← blocks invocation end end ```

0.2.2
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T16:14:53.934517+00:00	Ruby Importer	Affected by	VCID-kza3-e4r2-zba9	https://github.com/rubysec/ruby-advisory-db/blob/master/gems/turbo_boost-commands/CVE-2024-28181.yml	38.6.0

2026-06-04T16:14:53.934517+00:00

Ruby Importer

Affected by

VCID-kza3-e4r2-zba9

https://github.com/rubysec/ruby-advisory-db/blob/master/gems/turbo_boost-commands/CVE-2024-28181.yml

38.6.0

purl	pkg:gem/turbo_boost-commands@0.2
Tags	Ghost

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0