CVE-2022-46648: 
Ruby vulnerability analysis and mitigation

The vulnerability CVE-2022-46648 affects ruby-git versions prior to v1.13.0. This security flaw allows a remote authenticated attacker to execute arbitrary Ruby code by having a user load a repository containing a specially crafted filename to the product (NVD, JVN Report).

The vulnerability is classified as a code injection vulnerability (CWE-94). It has been assigned a CVSS v3.1 base score of 8.0 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. The vulnerability specifically relates to how ruby-git handles file paths in its ls-files functionality, where it previously used eval for unescaping paths, which could lead to code execution (NVD, Ruby-Git PR).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary Ruby code on the affected system. This could potentially lead to unauthorized access, data manipulation, or system compromise (JVN Report).

The vulnerability requires an authenticated user to load a repository containing a specially crafted filename. The attack complexity is considered low, but it does require user interaction and low-level privileges to execute (NVD).

The vulnerability has been fixed in ruby-git version 1.13.0. Users are advised to update to this version or later. For Debian 10 (buster) users, the fix has been backported to version 1.2.8-1+deb10u1 (Debian Advisory, Ruby-Git PR).