CVE-2013-4203: The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote att...

Security readout for executives and security teams

CVE-2013-4203 is a command-injection flaw in the Ruby rgpg gem before version 0.2.3. If an application exposes vulnerable rgpg processing to attacker-controlled input, an attacker may be able to make the server run unintended operating-system commands. Exposure is likely limited to Ruby applications that depend on rgpg versions before 0.2.3 and invoke the GPG helper with data influenced by remote users. The CVE does not identify specific downstream products or exact input vectors. Treat this as high priority for any internet-facing Ruby service using rgpg before 0.2.3. If rgpg is absent, there is no indicated exposure from this CVE. Prioritize dependency inventory first because the public record lacks downstream product names. Mitigation focus: Upgrade rgpg to version 0.2.3 or later where present.; Remove rgpg if it is unused or replace unsupported dependency paths.; Avoid passing untrusted input into rgpg processing until upgraded..

Prepared

Jun 14, 2026, 15:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.