CVE-2013-2090: The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows rem...

Security readout for executives and security teams

CVE-2013-2090 affects the Ruby Creme Fraiche gem before 0.6.1. If an application processes attacker-controlled email attachments through this gem, a crafted attachment filename could cause arbitrary command execution on the server. Exposure is likely limited to Ruby applications using Creme Fraiche before 0.6.1 and processing untrusted email attachments. The source bundle does not identify specific downstream products or deployment patterns. Prioritize remediation where Creme Fraiche handles inbound or external email attachments. Business urgency is high for exposed systems because successful exploitation could execute commands on application infrastructure. Mitigation focus: Upgrade Creme Fraiche to 0.6.1 or a later non-vulnerable version.; Check vendor or maintainer guidance before applying compensating controls.; Disable vulnerable attachment metadata processing if upgrade is not immediately possible..

Prepared

Jun 14, 2026, 07:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.