{"action":"Upgrade arr-pm to 0.0.12 or later.","affected":[{"fixed":"0.0.12","introduced":"0"}],"component":"arr-pm","cve_ids":["CVE-2022-39224"],"ecosystem":"RubyGems","epss":0.01457,"exploited":false,"fixed_versions":["0.0.12"],"ghsa_id":"GHSA-88cv-mj24-8w3q","id":"tcs_01M5KEHYXMJH5MKW25DVQ3SCHS","modified_at":"2023-11-08T04:10:15.515035Z","published_at":"2022-09-21T17:00:12Z","references":["https://osv.dev/vulnerability/GHSA-88cv-mj24-8w3q","https://github.com/jordansissel/ruby-arr-pm/security/advisories/GHSA-88cv-mj24-8w3q","https://nvd.nist.gov/vuln/detail/CVE-2022-39224","https://github.com/jordansissel/ruby-arr-pm/pull/14","https://github.com/jordansissel/ruby-arr-pm/pull/15","https://github.com/jordansissel/ruby-arr-pm","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/arr-pm/CVE-2022-39224.yml"],"severity":{"label":"high","score":7},"sources":[{"source":"osv","source_id":"GHSA-88cv-mj24-8w3q","url":"https://osv.dev/vulnerability/GHSA-88cv-mj24-8w3q"}],"summary":"arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm."}