Ruby · disclosed reports
Command and Code Injection
11 disclosed reports · $0 paid
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Ruby on HackerOne- reports
- 11
- paid a bounty
- 0
Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.
- OS Command Injection via egrep in Rake::FileList
- RCE by parsing `.rdoc_options` in RDoc
- Command injection in Pathname
- NET::Ftp allows command injection in filenames
- SMTP command injection
- Code Injection Bug Report
- OS Command Injection in 'rdoc' documentation generator
- Escape sequence injection vulnerability in WEBrick BasicAuth
- OS Command Injection in '/lib/un.rb -- Utilities to replace common UNIX commands in Makefiles etc'
- Command injection in OptionParser.load
- Potential command injection in `Shell#[]` and `Shell#test`
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.