Bug bounty program · HackerOne
Most upvoted reports73
- #651518ValidOS Command Injection via egrep in Rake::FileListRuby · Command and Code Injection · 2019–62votes
- #1131465ValidPath traversal in Tempfile on windows OS due to unsanitized backslashesRuby · File and Path Handling · 2021–54votes
- #965267ValidPotential HTTP Request Smuggling in ruby webrickRuby · Injection and Smuggling · 2020–53votes
- #1187477ValidRCE by parsing `.rdoc_options` in RDocRuby · Command and Code Injection · 2024–41votes
- #459084InformativeThe taint flag is not propagated at JSON.parseRuby · No weakness recorded · 2024–40votes
- #449482ValidCommand injection in PathnameRuby · Command and Code Injection · 2019–36votes
- #1485717ValidReDoS in IPAddrRuby · No weakness recorded · 2025–32votes
- #294462ValidNET::Ftp allows command injection in filenamesRuby · Command and Code Injection · 2017–28votes
- #499ValidRuby: Heap Overflow in Floating Point ParsingRuby · No weakness recorded · 2013–26votes
- #1487889ValidReDoS in PsychRuby · No weakness recorded · 2025–26votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.