Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions before 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an malicious user to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
asciidoctor-include-ext project asciidoctor-include-ext |
Vulmon