Advisory Package Curation

gollum and gollum-lib allow remote authenticated users to execute arbitrary code The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.

Improper Access Control The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.

Remote Code Execution In vulnerable versions of the gem, searching for the string `-O<arbitrary command>` or `--open-files-in-pager <arbritary command>` in the wiki's search field will execute an arbitrary shell command. However, this will only work if the string "master" (or more precisely, the name of the git branch that gollum is using) is found in one of the wiki's files: "master" is then interpreted as the search query, `-O<arbitary code>` as a command line option to `git grep`.

Improper Access Control The gollum-grit_adapter Ruby gem dependency in gollum and the gollum-lib gem dependency in gollum-lib when the string "master" is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the -O or --open-files-in-pager flags.

gollum and gollum-lib allow remote authenticated users to execute arbitrary code The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.

gollum-grit_adapter Search Functionality Allows Arbitrary Command Execution The gollum-grit_adapter gem contains a flaw that can allow arbitrary command execution. Grit implements its search functionality by shelling out to `git grep`. In turn, `git grep` takes a `-O` or `--open-files-in-pages` option that will pipe the results of `grep` to an arbitrary process. By failing to properly sanitize user input search parameters, an attacker can thus perform command execution. Note that the grep result must find the string 'master' (or whatever is the default branch that gollum uses) in any of the wiki's documents for this to succeed.

gollum and gollum-lib allow remote authenticated users to execute arbitrary code The gollum-grit_adapter Ruby gem dependency in gollum before 3.1.1 and the gollum-lib gem dependency in gollum-lib before 4.0.1 when the string `master` is in any of the wiki documents, allows remote authenticated users to execute arbitrary code via the `-O` or `--open-files-in-pager` flags.