Description
An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Remediation
References
Related Vulnerabilities
WordPress Plugin Integration for Contact Form 7 and Zoho Cross-Site Scripting (1.1.7)
WordPress Plugin User Control SQL Injection (2.1.0)
ownCloud Improper Input Validation Vulnerability (CVE-2015-7699)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-7832)
WordPress Plugin Multiple Roles Cross-Site Request Forgery (1.3.1)