Zennoxa Shield
Rules / Ruby
SHIELD-RUBY-006

Command injection via Open3 or spawn with variable

highRubyCWE-78CVSS 8.8

What it detects

Passing a single interpolated string to Open3 or Kernel.spawn invokes a shell and permits injection.

How to fix

Provide the command and each argument as distinct array elements to Open3 or spawn.

Vulnerable — Shield flags thisvideo_transcoder.rb
require "open3"

class VideoTranscoder
  def transcode(input_file)
    stdout, stderr, status = Open3.capture3("ffmpeg -i #{input_file} -f mp4 out.mp4")
    status.success? ? stdout : stderr
  end
end
Fixed — scans cleanvideo_transcoder.rb
require "open3"

class VideoTranscoder
  def transcode(input_file)
    stdout, stderr, status = Open3.capture3("ffmpeg", "-i", input_file, "-f", "mp4", "out.mp4")
    status.success? ? stdout : stderr
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-006, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-RUBY-006: Command injection via Open3 or spawn with variable — Zennoxa Shield