Malicious code in array-xml-serialization (RubyGems)
Summary
MAL-2024-6685: Malicious code in array-xml-serialization (RubyGems). Affects array-xml-serialization versions 0.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The array-xml-serialization package is a RubyGem that provides functionality for serializing arrays to XML format. It is commonly used in Ruby applications for converting arrays to XML representations. This package is vulnerable to a malicious code injection attack.
Vulnerability Detail
The vulnerability originates from a malicious code injection in the array-xml-serialization package. An attacker can exploit this vulnerability by crafting a specially crafted XML input that triggers the execution of arbitrary code. This can lead to various security risks, including remote code execution, data leakage, and unauthorized access to sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
bundle remove array-xml-serializationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the package to a non-malicious version as soon as possible.
Conclusion
The array-xml-serialization package in RubyGems is vulnerable to a malicious code injection attack. It is crucial for users to update their dependencies to a non-malicious version to mitigate the risk of remote code execution, data leakage, and unauthorized access to sensitive information.
See every vulnerability recorded for array-xml-serialization →
FAQ
This vulnerability can lead to remote code execution, data leakage, and unauthorized access to sensitive information.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if any open-source vulnerabilities, including this one, are found.
Yes, the maintainers of the array-xml-serialization package have released a patched version that addresses this vulnerability. It is recommended to update your dependencies to the latest version.
No, there are no known workarounds for this vulnerability. Updating the package to a non-malicious version is the only solution.
This vulnerability was discovered by ReversingLabs, a cybersecurity company specializing in threat intelligence and malware analysis.
