NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
💎
💎 RubyGems
Not in CISA KEV
HIGH severity

ExifTool vulnerable to arbitrary code executionGHSA-q95h-cqrv-8jv5

HIGH

GHSA-q95h-cqrv-8jv5 is a high-severity (CVSS 7.8) remote code execution vulnerability in exiftool_vendored. A fix is available for exiftool_vendored — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 29, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
💎exiftool_vendored

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Arbitrary code execution can occur when running exiftool against files with hostile metadata payloads

Patches

ExifTool has already been patched in version 12.24. exiftool_vendored.rb, which vendors ExifTool, includes this patch in v12.25.0.

Workarounds

No

References

https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204

For more information

If you have any questions or comments about this advisory:

Open an issue in exiftool_vendored.rb

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
💎RubyGemsexiftool_vendoredall versions12.25.0bundle update exiftool_vendored --conservative

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for exiftool_vendored, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update exiftool_vendored to 12.25.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-q95h-cqrv-8jv5 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads ### Patches ExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0). ### Workarounds No ### References https://twitter.com/wcbowling/status/1385803927321415687 https://nvd.nist.gov/vuln/detail/CVE-2021-22204 ### For more information If you have any questions or comments about this advisory: Open an issue in [exiftool_vendored
O3 Security · Impact-Aware SCA

Is GHSA-q95h-cqrv-8jv5 in your dependencies?

Find it across RubyGems, including transitive dependencies.

Scan my dependencies How O3 SCA works
ExifTool vulnerable to arbitrary code execution (High 7.8)