# Escape sequence injection in "summary" field

RubyGems printed unsanitized escape sequences from a gem's summary field to the terminal, letting a malicious gem retitle windows or inject terminal commands.

- Payout: $500
- Severity: low
- Program: RubyGems
- Credited: mame
- Disclosed: 2017-08-30
- CVE: CVE-2017-0899
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/226335
- Library page: https://bugbountylibrary.com/r/h1%3A226335
- Tags: domain:oss impact:rce kind:bounty platform:hackerone sev:low tech:ruby technique:source-review vuln:command-injection

**Target:** gem CLI summary field rendering
**Root cause:** The gem summary field is printed to the terminal without stripping ANSI/escape sequences, so attacker-controlled bytes reach the terminal emulator.
**Steps:**
1. Create gemspec with `spec.summary = "foo\e[31mbar\e[0mbaz \e]2;BOOM!\a"`
2. `gem build escape-sequence-injection-vulnerability.gemspec`
3. `gem install escape-sequence-injection-vulnerability-0.0.1.gem`
4. `gem query escape-sequence-injection-vulnerability -d && sleep 10`
5. Observe colored text and window title changed to BOOM!
**How found:** Noticed the summary field accepts arbitrary escape sequences and is echoed verbatim to the terminal; referenced prior WEBrick escape-sequence injection vulnerability as precedent.
**Exploitation:** Attacker publishes a gem with malicious escape sequences in summary; victim runs `gem search <gem> -d` and the sequences execute in their terminal emulator, potentially injecting commands leading to code execution.
**Insight:** Any CLI that prints package metadata (summaries, descriptions, author names) to a terminal is a candidate for escape-sequence injection; test fields that flow from registry to terminal output.