Dozens of Ruby-related CVEs have been caused by user input being passed to the top-level Kernel.open()
method, which not only accepts paths or URIs (if open-uri
has been loaded), but also "|command-here"
commands which are then opened using IO.popen()
resulting in Remote Command Execution (RCE) vulnerabilities. In the next minor Ruby version (3.3.0) a deprecation warning will be printed if a "|command-here"
input is given to Kernel.open()
. Hopefully, in Ruby 4.0 this insecure feature will be removed.