The vulnerability exists in the awesome method array helper of a Ruby printing library. A specially named method that contains Ruby interpolation syntax can be resolved into an interpolated string when the grep method is called with a block. The resulting string is then evaluated with eval, allowing any Ruby code contained in the method name to be executed in the host process. This is a classic code injection flaw where an attacker can run arbitrary code if they can control the method name. The impact is local code execution in the context of the application using the library, potentially leading to full system compromise if the host process runs with privileged rights.

The affected product is the Ruby gem amazing-print, version at commit dc890dfafdf07088ea901df53c19c2710e5c5234. No other vendors or product versions are listed in the advisory, so only this specific gem is known to be vulnerable.

A CVSS score of 8.4 indicates high severity, and EPSS is not available; the vulnerability is not listed in CISA’s KEV catalog. The attack vector requires an attacker to be able to influence the name of a method that the application will dynamically refer to; this may be possible in applications that allow user‑supplied or configuration‑driven method names. Because the flaw relies on a dynamic eval, exploitation is only feasible when the attacker can provide a method name that includes interpolated Ruby code. The lack of publicly available metrics suggests that the overall risk is uncertain, but the potential for arbitrary code execution in a process that may have elevated privileges is high once the conditions are met.