CVE-2023-28102: discordrb OS Command Injection vulnerability

Should you act?

Normal patch cycle

No exploitation signal; fix it in your next routine update if you are affected. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
• EPSS 2.6%, percentile 85: FIRST’s model estimates a 2.6% chance of exploitation activity in the next 30 days, higher than 85% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
• Needs a user to click or open something. Phishing makes that realistic, but it is not wormable.
• Only applies if your dependency tree includes discordrb (RubyGems) < 3.4.3, fixed in 3.4.3. Check your lockfile, including transitive dependencies.

What it is

discordrb is an implementation of the Discord API using Ruby. In discordrb before commit 91e13043ffa the encoder.rb file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the discordrb library and will likely not be total system access. This issue has been addressed in code, but a new release of the discordrb gem has not been uploaded to rubygems. This issue is also tracked as GHSL-2022-094.

From the GitHub advisory

discordrb is an implementation of the Discord API using Ruby. In discordrb before commit 91e13043ffa the encoder.rb file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the discordrb library and will likely not be total system access. This issue has been addressed in code, but a new release of the discordrb gem has not been uploaded to rubygems. This issue is also tracked as GHSL-2022-094.

Weakness type: CWE-78.

Product: discordrb (RubyGems) · Assigned by: GitHub_M · Published: 2023-03-27

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: high (needs special conditions)
• Privileges required: none (no login)
• User interaction: required (a user must click/open something)
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 2.57% probability of exploitation activity in the next 30 days; percentile 85.

Timeline

• 2023-03-27 — CVE record published by GitHub_M
• 2024-03-14 — GitHub-reviewed advisory GHSA-8832-4mm5-x2r6 published (critical)
• 2025-02-19 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vulnerability records

1. GitHub Advisory GHSA-8832-4mm5-x2r6 github.com
2. CVE.org record CVE-2023-28102 cve.org
3. NVD entry CVE-2023-28102 nvd.nist.gov

Other references from the CVE record and advisory

1. securitylab.github.com securitylab.github.com
2. github.com github.com
3. github.com github.com
4. securitylab.github.com securitylab.github.com

Critical RubyGems advisories · Today’s Security Digest