CVE-2013-6421: Projectsprouts Sprout

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

Affected products

• Projectsprouts Sprout: version 0.7.246 only

Published 2013-12-12. Last modified 2026-06-17.