Threats tagged 'ghsa-xrw4-g928-4w5v'

A vulnerability in rubygem-safemode allows authenticated attackers with template editing privileges to bypass the sandbox Jail allow-list via compound assignment expressions. This flaw enables invocation of arbitrary no-argument methods on objects exposed to the template renderer without mediation, potentially leading to destructive actions such as host deletion and unauthorized disclosure of object state.