From 91463b3d5689a0a0a1c5e7f7fce1259fb57c39e5 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Tue, 3 Nov 2026 13:04:13 -0500
Subject: [PATCH 1/2] One new ransack advisory

---
 gems/ransack/GHSA-58rx-96gf-w92x.yml | 60 ++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)
 create mode 100644 gems/ransack/GHSA-58rx-96gf-w92x.yml

diff --git a/gems/ransack/GHSA-58rx-96gf-w92x.yml b/gems/ransack/GHSA-58rx-96gf-w92x.yml
new file mode 100644
index 0000000000..bd508e08ff
--- /dev/null
+++ b/gems/ransack/GHSA-58rx-96gf-w92x.yml
@@ -0,0 +1,60 @@
+---
+gem: ransack
+ghsa: 58rx-96gf-w92x
+url: https://github.com/activerecord-hackery/ransack/security/advisories/GHSA-58rx-96gf-w92x
+title: Ransack - sort_link and sort_url take url_for options from
+  request params, allowing reflected XSS and open redirect
+date: 2025-10-25
+description: |
+  ## Impact
+
+  sort_link and sort_url build the link by passing every request parameter
+  to url_for, removing only host. url_for reads several keys as URL
+  structure rather than as query parameters, so a crafted query string
+  controls the link that every sort link on the page renders.
+
+  ### Reflected XSS.
+
+  url_for prepends script_name and original_script_name to the path
+  without validating them. A link such as
+
+  * https://victim.example/posts?script_name=javascript:alert(document.domain)//
+
+  makes the page's sort links render as
+  href="javascript:alert(document.domain)//posts?q%5Bs%5D=title+asc".
+  A victim who opens the attacker's link and then clicks a sort link
+  runs the attacker's script in the application's origin.
+
+  ### Open redirect.
+
+  A value-less ?only_path arrives as nil, which skips ActionView's
+  only_path: true default. protocol, domain, subdomain, port, user
+  and password then point the sort links at another origin. Through
+  a routing proxy (sort_link([:main_app, @q], ...)) a full URL is
+  built anyway, so only_path is not needed.
+
+  Errors. use_route switches the link to another named route, and a
+  non-hash _recall raises TypeError, so the page returns a 500.
+
+  Any page that renders sort_link or sort_url is affected with the
+  default setup, and the attacker needs no account. The victim has
+  to open the crafted link and then click a sort link. The search
+  itself is unaffected.
+cvss_v3: 6.1
+patched_versions:
+  - "~> 4.4.4"
+  - "~> 5.0.3"
+  - ">= 6.0.1"
+related:
+  url:
+    - https://rubygems.org/gems/ransack/versions/6.0.1
+    - https://github.com/activerecord-hackery/ransack/releases#release-v6.0.1
+    - https://rubygems.org/gems/ransack/versions/5.0.3
+    - https://github.com/activerecord-hackery/ransack/releases#release-v5.0.3
+    - https://rubygems.org/gems/ransack/versions/4.4.4
+    - https://github.com/activerecord-hackery/ransack/releases#release-v4.4.4
+    - https://github.com/advisories/GHSA-r5jw-62xg-j433
+    - https://github.com/activerecord-hackery/ransack/security/advisories/GHSA-58rx-96gf-w92x
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.

From b5b2373815ffd5128bf204e1a874aa7323fb6667 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Tue, 3 Nov 2026 15:50:53 -0500
Subject: [PATCH 2/2] Change advisory date from 2025 to 2026

Updated the date for the Ransack security advisory.
---
 gems/ransack/GHSA-58rx-96gf-w92x.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gems/ransack/GHSA-58rx-96gf-w92x.yml b/gems/ransack/GHSA-58rx-96gf-w92x.yml
index bd508e08ff..0bd859e321 100644
--- a/gems/ransack/GHSA-58rx-96gf-w92x.yml
+++ b/gems/ransack/GHSA-58rx-96gf-w92x.yml
@@ -4,7 +4,7 @@ ghsa: 58rx-96gf-w92x
 url: https://github.com/activerecord-hackery/ransack/security/advisories/GHSA-58rx-96gf-w92x
 title: Ransack - sort_link and sort_url take url_for options from
   request params, allowing reflected XSS and open redirect
-date: 2025-10-25
+date: 2026-10-25
 description: |
   ## Impact