CVE-2023-28102

discordrb is an implementation of the Discord API using Ruby. In discordrb before commit `91e13043ffa` the `encoder.rb` file unsafely constructs a shell string using the file parameter, which can potentially leave clients of discordrb vulnerable to command injection. The library is not directly exploitable: the exploit requires that some client of the library calls the vulnerable method with user input. However, if unsafe input reaches the library method, then an attacker can execute arbitrary shell commands on the host machine. Full impact will depend on the permissions of the process running the `discordrb` library and will likely not be total system access. This issue has been addressed in code, but a new release of the `discordrb` gem has not been uploaded to rubygems. This issue is also tracked as `GHSL-2022-094`.

• CWE-78

• https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95Patch
• https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/Exploit, Third Party Advisory
• https://github.com/shardlab/discordrb/commit/91e13043ffa89227c3fcdc3408f06da237d28c95Patch
• https://securitylab.github.com/advisories/GHSL-2022-094_discordrb/Exploit, Third Party Advisory

Published

Mar 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28096OpenSIPS, a Session Initiation Protocol (SIP) server impleme…7.5
• CVE-2023-28097OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28098OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28099OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2023-28100Flatpak is a system for building, distributing, and running …6.5
• CVE-2023-28101Flatpak is a system for building, distributing, and running …4.3
• CVE-2023-28103matrix-react-sdk is a Matrix chat protocol SDK for React Jav…8.2
• CVE-2023-28104`silverstripe/graphql` serves Silverstripe data as GraphQL r…7.5
• CVE-2023-28105go-used-util has commonly used utility functions for Go. Ver…8.8
• CVE-2023-28106Pimcore is an open source data and experience management pla…4.8
• CVE-2023-28107Discourse is an open-source discussion platform. Prior to ve…4.9
• CVE-2023-28108Pimcore is an open source data and experience management pla…7.8