CVE-2021-33575
CRITICALPixar ruby-jss < 1.6.0 - Remote Code Execution via Plist Marshal.load
Title source: llmDescription
The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
References (2)
Core 2
Core References
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/PixarAnimationStudios/ruby-jss/blob/e6d48dd8c77f9275c76787d60d3472615fcd9b77/CHANGES.md#160---2021-05-24
Third Party Advisory x_refsource_misc
https://github.com/patsplat/plist/tree/ce8f9ae42a114f603ea200c955e420782bffc4ad#label-Security+considerations
Scores
CVSS v3
9.8
EPSS
0.0176
EPSS Percentile
82.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (2)
pixar/ruby-jss
< 1.6.0
rubygems/ruby-jss
0 - 1.6.0RubyGems
Published
May 25, 2021
Tracked Since
Feb 18, 2026