From ebe7d8c2d965030ad9813f697b890aaa41b14107 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 3 Nov 2026 23:29:18 -0500 Subject: [PATCH] Add Rails 8.0.5.2 and 8.1.4.1 advisories ref: https://rubyonrails.org/2026/11/4/Rails-8.0.5.2-and-8.1.4.1-have-been-released --- gems/actionmailbox/GHSA-5957-c7qm-m469.yml | 61 +++++++++++ gems/actionpack/GHSA-2586-8ghr-69fj.yml | 62 +++++++++++ gems/actionpack/GHSA-2gff-2mmg-m73p.yml | 99 +++++++++++++++++ gems/actionpack/GHSA-gmj8-hvj3-49mw.yml | 68 ++++++++++++ gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml | 75 +++++++++++++ gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml | 51 +++++++++ gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml | 79 ++++++++++++++ gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml | 74 +++++++++++++ gems/actionview/GHSA-2p2f-4rq4-gjwc.yml | 67 ++++++++++++ gems/actionview/GHSA-68p9-83h6-5wpj.yml | 53 +++++++++ gems/actionview/GHSA-rq8q-p985-fjq7.yml | 63 +++++++++++ gems/actionview/GHSA-v6rj-xm57-3p59.yml | 67 ++++++++++++ gems/activestorage/GHSA-3f4q-8x5m-76v8.yml | 71 ++++++++++++ gems/activestorage/GHSA-3w93-6hmw-whh4.yml | 72 ++++++++++++ gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml | 67 ++++++++++++ gems/activestorage/GHSA-f3w6-w445-fwh9.yml | 121 +++++++++++++++++++++ gems/activestorage/GHSA-hfr4-8rjc-97m2.yml | 63 +++++++++++ gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml | 62 +++++++++++ gems/activestorage/GHSA-v924-7rp8-4mxh.yml | 111 +++++++++++++++++++ gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml | 65 +++++++++++ gems/activesupport/GHSA-8474-xrp6-wh69.yml | 88 +++++++++++++++ 21 files changed, 1539 insertions(+) create mode 100644 gems/actionmailbox/GHSA-5957-c7qm-m469.yml create mode 100644 gems/actionpack/GHSA-2586-8ghr-69fj.yml create mode 100644 gems/actionpack/GHSA-2gff-2mmg-m73p.yml create mode 100644 gems/actionpack/GHSA-gmj8-hvj3-49mw.yml create mode 100644 gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml create mode 100644 gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml create mode 100644 gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml create mode 100644 gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml create mode 100644 gems/actionview/GHSA-2p2f-4rq4-gjwc.yml create mode 100644 gems/actionview/GHSA-68p9-83h6-5wpj.yml create mode 100644 gems/actionview/GHSA-rq8q-p985-fjq7.yml create mode 100644 gems/actionview/GHSA-v6rj-xm57-3p59.yml create mode 100644 gems/activestorage/GHSA-3f4q-8x5m-76v8.yml create mode 100644 gems/activestorage/GHSA-3w93-6hmw-whh4.yml create mode 100644 gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml create mode 100644 gems/activestorage/GHSA-f3w6-w445-fwh9.yml create mode 100644 gems/activestorage/GHSA-hfr4-8rjc-97m2.yml create mode 100644 gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml create mode 100644 gems/activestorage/GHSA-v924-7rp8-4mxh.yml create mode 100644 gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml create mode 100644 gems/activesupport/GHSA-8474-xrp6-wh69.yml diff --git a/gems/actionmailbox/GHSA-5957-c7qm-m469.yml b/gems/actionmailbox/GHSA-5957-c7qm-m469.yml new file mode 100644 index 0000000000..4268c1cbef --- /dev/null +++ b/gems/actionmailbox/GHSA-5957-c7qm-m469.yml @@ -0,0 +1,61 @@ +--- +gem: actionmailbox +framework: rails +ghsa: 5957-c7qm-m469 +url: https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469 +title: "Possible signature replay in Action Mailbox Mailgun ingress" +date: 2026-11-04 +description: | + ### Impact + + The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the + `timestamp` and `token` parameters concatenated without a separator, and + `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?` + rejects only timestamps more than 2 minutes in the past. Because the signature + does not fix the boundary between the two values, a captured signed request + can be presented with a timestamp far in the future, which the ingress then + accepts indefinitely. An attacker who obtains one signed Mailgun webhook + request, but not the signing key, could submit arbitrary inbound email that + Action Mailbox processes as genuine, possibly leading to forged messages + attributed to the sender of the attacker's choosing. + + Applications that receive inbound email through the Action Mailbox Mailgun + ingress are affected. + + ### Details + + The fixed releases also reject a Mailgun request whose timestamp is more than + 2 minutes ahead of the server's clock, as they already did for one more than 2 + minutes behind it. An application whose clock runs more than 2 minutes behind + Mailgun's will now reject genuine webhooks and should synchronize its clock. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a.patch + - 8.0: + https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [davutselcuk](https://hackerone.com/davutselcuk). +cvss_v3: 3.7 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionmailbox/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionmailbox/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a + - https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34 + - https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-2586-8ghr-69fj.yml b/gems/actionpack/GHSA-2586-8ghr-69fj.yml new file mode 100644 index 0000000000..f932a2fb9b --- /dev/null +++ b/gems/actionpack/GHSA-2586-8ghr-69fj.yml @@ -0,0 +1,62 @@ +--- +gem: actionpack +framework: rails +ghsa: 2586-8ghr-69fj +url: https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj +title: "Possible restoration of destroyed sessions in Action Dispatch + CacheStore" +date: 2026-11-04 +description: | + ### Impact + + `ActionDispatch::Session::CacheStore` writes a session back to the cache at + the end of each request that loaded it, without checking that the session's + cache entry still exists. When a concurrent request destroys the session, + through `reset_session` on logout or by deleting its cache entry on the + server, a request that loaded the session earlier and finishes later restores + it under its original session ID. Logout and server-side revocation could + therefore fail to end a session, and an attacker who holds a stolen session + cookie could keep that session valid across the victim's logout. + + Applications that use `config.session_store :cache_store` are affected, with + any cache backend. `ActionDispatch::Session::CookieStore` is not affected, nor + is `ActionDispatch::Session::MemCacheStore` with Dalli 4.0.0 or later, whose + session store does not write back a session that was deleted. + + ### Details + + The fixed releases record which session a request loaded and skip the write + when that session's cache entry no longer exists. Changes that such a request + makes to the destroyed session are discarded, and Rack logs a warning that the + session could not be saved. Each request that writes back a session it loaded + makes one additional cache read. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f.patch + - 8.0: + https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5.patch + + ### Credit + + Found by the team during internal code review. +cvss_v3: 4.2 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f + - https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5 + - https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-2gff-2mmg-m73p.yml b/gems/actionpack/GHSA-2gff-2mmg-m73p.yml new file mode 100644 index 0000000000..a629ec0506 --- /dev/null +++ b/gems/actionpack/GHSA-2gff-2mmg-m73p.yml @@ -0,0 +1,99 @@ +--- +gem: actionpack +framework: rails +ghsa: 2gff-2mmg-m73p +url: https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p +title: "Possible IP spoofing in Action Dispatch RemoteIp" +date: 2026-11-04 +description: | + ### Impact + + Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from + `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239 + `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy + appends the client address to `X-Forwarded-For` but passes a client-supplied + `Forwarded` header through unchanged, `request.remote_ip` returns an address + chosen by the client, and the IP spoofing check does not raise, because it + compares only `Client-Ip` with the forwarded addresses. An unauthenticated + attacker could therefore spoof `request.remote_ip`, possibly bypassing + IP-based access controls and rate limits keyed on the client address + (including the default `by:` of `rate_limit`), and falsifying the client + address in logs. + + ### Details + + The 8.1.0 change + ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d)) + switched `ActionDispatch::RemoteIp` from reading `X-Forwarded-For` directly to + Rack's `forwarded_for`, in order to reuse Rack's port handling. Rails + continues to honor `Forwarded`, the standard header. + + In the fixed releases, when `config.action_dispatch.ip_spoofing_check` is + enabled (the default), `ActionDispatch::RemoteIp` also compares the first + untrusted client address in `Forwarded` with the first untrusted client + address in `X-Forwarded-For`, as exact strings, and raises + `ActionDispatch::RemoteIp::IpSpoofAttackError` when both headers are present + and the addresses differ. Deployments whose proxies report the client address + inconsistently between the two headers will receive this error after + upgrading. See the `actionpack` CHANGELOG. + + ### Affected applications + + An application is affected if it meets all of these requirements: + - Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, `forwarded_for` + reads only `X-Forwarded-For`. + - Is served behind a proxy that does not remove or overwrite a client-supplied + `Forwarded` header. + - Relies on `request.remote_ip` for access control, rate limiting, or + auditing. + + The fix detects a spoofed `Forwarded` header only when the proxy also sets + `X-Forwarded-For`. An application whose proxy passes a client-supplied + `Forwarded` header through and sets no `X-Forwarded-For` remains exposed after + upgrading, and should configure the proxy to remove or overwrite `Forwarded`, + or apply the workaround below. + + ### Mitigation + + - Upgrade to a fixed version of `actionpack`. + - Configure reverse proxies to remove or overwrite any client-supplied + `Forwarded` header. + + ### Workarounds + + Applications whose proxies set `X-Forwarded-For` can make Rack ignore the + `Forwarded` header, restoring the client address resolution of Rails 8.0, by + setting `Rack::Request.forwarded_priority = [:x_forwarded]` in an initializer. + This setting is available in Rack 3.0.0 and later, and it also causes Rack to + ignore `Forwarded` when determining the request scheme, host, and port. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227.patch + + ### Versions affected + + - actionpack >= 8.1, < 8.1.4.1 + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [luryus](https://hackerone.com/luryus). +cvss_v3: 7.4 +unaffected_versions: + - "< 8.1.0" +patched_versions: + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227 + - https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml b/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml new file mode 100644 index 0000000000..4dc471dc9b --- /dev/null +++ b/gems/actionpack/GHSA-gmj8-hvj3-49mw.yml @@ -0,0 +1,68 @@ +--- +gem: actionpack +framework: rails +ghsa: gmj8-hvj3-49mw +url: https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw +title: "Missing SameSite attribute on session cookies from Action Pack session + stores" +date: 2026-11-04 +description: | + ### Impact + + Action Pack session stores other than `ActionDispatch::Session::CookieStore` + (`CacheStore`, `MemCacheStore`, and third-party stores built on + `AbstractStore`, `AbstractSecureStore` or the session mixins) write the + session cookie without a `SameSite` attribute, regardless of + `config.action_dispatch.cookies_same_site_protection`, which defaults to + `:lax`. Only `CookieStore` applies the configured policy. In browsers that do + not treat a cookie without the attribute as `SameSite=Lax`, a cross-site + request could carry the session cookie, possibly leading to cross-site request + forgery against actions that do not verify an authenticity token, such as + those of API-only applications. + + Applications are affected when they use a session store other than + `CookieStore` and do not pass `same_site:` to `config.session_store`. + + ### Details + + In the fixed releases, every session store sets the session cookie's + `SameSite` attribute from `cookies_same_site_protection` when its options have + no `:same_site` key. An explicit `same_site:` option, including + `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS` + still take precedence. + + ### Workarounds + + Pass `same_site:` when configuring the session store, for example + `config.session_store :cache_store, same_site: :lax`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch + - 8.0: + https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [tjvc](https://hackerone.com/tjvc). +cvss_v3: 3.1 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46 + - https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef + - https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml b/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml new file mode 100644 index 0000000000..5a890b9dee --- /dev/null +++ b/gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml @@ -0,0 +1,75 @@ +--- +gem: actionpack +framework: rails +ghsa: r9jg-fmfx-2gv6 +url: https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6 +title: "Possible cache poisoning in Action Pack content negotiation" +date: 2026-11-04 +description: | + ### Impact + + Action Pack negotiates the format of a rendered response from the `Accept`, + `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type` + request headers, but `ActionController::Rendering#_set_vary_header` adds + `Vary: Accept` only when the request carries a usable `Accept` header and the + response has no `Vary` header yet. A response to a request without `Accept`, + or to an XHR request, therefore omits the headers that selected its + representation, and a response whose `Vary` the application set before + rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared + cache that honours `Vary` could store such a response and serve it to later + clients that request a different representation, possibly leading to cache + poisoning in which visitors receive, until the entry expires, a page without + its layout or HTML in place of JSON. The attacker cannot choose the content of + the response. + + Applications that render negotiated responses from actions marked `public` + (for example with `expires_in ..., public: true`) behind a shared cache that + honours `Vary`, such as Thruster or `Rack::Cache`, are affected. + + ### Details + + In the fixed releases, a rendered response whose format is not given by the + URL lists `Accept` and `X-Requested-With` in `Vary`, and also `Content-Type` + for an XHR request without `Accept`; when + `config.action_dispatch.ignore_accept_header` is enabled, it lists only + `X-Requested-With`. These fields are appended to an existing `Vary` value + rather than skipped, and `Vary: *` is left unchanged. Shared caches can store + more variants of such responses than before. See the Action Pack CHANGELOG for + details. + + ### Workarounds + + Set `Vary: Accept, X-Requested-With` on negotiated responses in the + application, for example in an `after_action`, or do not mark negotiated + responses `public`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b.patch + - 8.0: + https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c.patch + + ### Credit + + This issue was found by the Anthropic OSS Scanner (ANT-2026-7GHGLQGO, + ANT-2026-5MT6C2R3). +cvss_v3: 4.8 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b + - https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c + - https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml b/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml new file mode 100644 index 0000000000..a184f248f4 --- /dev/null +++ b/gems/actionpack/GHSA-rwvh-fw6r-pwvp.yml @@ -0,0 +1,51 @@ +--- +gem: actionpack +framework: rails +ghsa: rwvh-fw6r-pwvp +url: https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp +title: "Possible DoS vulnerability in Action Controller Live streaming" +date: 2026-11-04 +description: | + ### Impact + + `ActionController::Live::Buffer#close` pushes its end-of-stream marker onto + the response's bounded queue while it holds the buffer's monitor. When the + client has stopped reading and the queue is full, the push blocks, and + `Buffer#abort`, which runs when the client disconnects or a write times out, + waits indefinitely for the same monitor. Each such response could permanently + hold a web server thread and its `ActionController::Live` thread, possibly + resulting in a DoS vulnerability through thread exhaustion. + + Applications that stream responses with `ActionController::Live`, including + `send_stream`, are affected. Applications that serve large files through + Active Storage proxy mode are exposed to unauthenticated clients. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc.patch + - 8.0: + https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215.patch + + ### Credit + + This issue was found by the Anthropic OSS Scanner (ANT-2026-LDFW5N2T). +cvss_v3: 5.9 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/ccbfc09690fef05fdd2a9969c917a71b92cc98fc + - https://github.com/rails/rails/commit/27ad18ed5900dee28ba20e9c6fc718ff751fa215 + - https://github.com/rails/rails/security/advisories/GHSA-rwvh-fw6r-pwvp +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml b/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml new file mode 100644 index 0000000000..7dbf125a31 --- /dev/null +++ b/gems/actionpack/GHSA-wm3x-v3qw-4jh3.yml @@ -0,0 +1,79 @@ +--- +gem: actionpack +framework: rails +ghsa: wm3x-v3qw-4jh3 +url: https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3 +title: "Possible Strong Parameters bypass in Parameters#each_key in Action Pack" +date: 2026-11-04 +description: | + ### Impact + + `ActionController::Parameters#each_key` delegates to the internal + `ActiveSupport::HashWithIndifferentAccess` that holds the request parameters, + so when called with a block it returns that hash instead of the `Parameters` + instance. The hash does not respond to `permitted?`, so Active Model mass + assignment (`new`, `assign_attributes`, `update`) accepts it without raising + `ActiveModel::ForbiddenAttributesError`. An application that passes the return + value of `each_key` to mass assignment could allow a remote, unauthenticated + attacker to set attributes that the application does not permit, such as an + authorization flag. + + This is an incomplete fix of + [CVE-2020-8164](https://github.com/advisories/GHSA-8727-m6gj-mc37), which made + `each`, `each_pair` and `each_value` return the `Parameters` instance but left + `each_key` delegated. + + ### Details + + The fixed releases define `Parameters#each_key` to yield each key and return + the `Parameters` instance when given a block, as `each`, `each_pair` and + `each_value` do, and to return an `Enumerator` without one. Code that used the + return value of `each_key` as a hash now receives the `Parameters` instance, + which mass assignment rejects unless it is permitted. + + ### Affected applications + + An application is affected if it passes the return value of + `ActionController::Parameters#each_key`, called with a block, to mass + assignment. Rails itself makes no such call. + + ### Workarounds + + Do not use the return value of `each_key`. Call it for its block only, and + pass the permitted `Parameters` instance to mass assignment. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac.patch + - 8.0: + https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c.patch + + ### Versions affected + + - actionpack < 8.0.5.2 + - actionpack >= 8.1, < 8.1.4.1 + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [smlee](https://hackerone.com/smlee). +cvss_v3: 7.5 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/8ba746e0a786458c281060823f2ccc5c5f6312ac + - https://github.com/rails/rails/commit/2fc8838300133931e19eed3ea6cee76a7e83f19c + - https://github.com/rails/rails/security/advisories/GHSA-wm3x-v3qw-4jh3 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml b/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml new file mode 100644 index 0000000000..9082a8fe77 --- /dev/null +++ b/gems/actionpack/GHSA-x6mj-8jx9-qhqv.yml @@ -0,0 +1,74 @@ +--- +gem: actionpack +framework: rails +ghsa: x6mj-8jx9-qhqv +url: https://github.com/rails/rails/security/advisories/GHSA-x6mj-8jx9-qhqv +title: "Possible sensitive session information leak in Active Storage proxy + mode" +date: 2026-11-04 +description: | + ### Impact + + When `ActionDispatch::Cookies` reads a signed or encrypted cookie that was + written under a rotated secret (`config.action_dispatch.cookies_rotations`) or + in the format that a `:hybrid` cookie serializer migrates from, it writes the + cookie back to the response in the current format, and that write ignores + `request.session_options[:skip]`. `ActiveStorage::DisableSession` relies on + that option to keep the session cookie off the public, immutable responses of + the Active Storage proxy controllers, but those controllers still load the + session, so a request carrying an old-format session cookie could receive the + rewritten session cookie in `Set-Cookie` on a cacheable response. A shared + cache that stores such a response together with its `Set-Cookie` header could + then serve one user's session to later requesters of the same URL, or serve an + attacker's session to other users. + + Applications are affected when they serve Active Storage files through the + proxy controllers, have a cookie rotation or a `:hybrid` serializer migration + configured, and run behind a cache that stores `Set-Cookie` on public + responses. This is a path around the fix for + [CVE-2024-26144](https://github.com/advisories/GHSA-8h22-8cf7-hq6g). + + ### Details + + In the fixed releases, a response that skips the session leaves an old-format + signed or encrypted cookie unchanged, and the next request that does not skip + the session upgrades it. An application that skips the session on every + request no longer upgrades its signed or encrypted cookies. Cookies that the + application sets explicitly are still written. See the Action Pack CHANGELOG. + + ### Workarounds + + Configure caching proxies not to store responses that carry a `Set-Cookie` + header, or complete the cookie rotation or serializer migration and remove it + from the configuration. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556.patch + - 8.0: + https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [flashmyname](https://hackerone.com/flashmyname). +cvss_v3: 6.8 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionpack/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionpack/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/849a6c30eacbb6ca4722132f43c4333a93188556 + - https://github.com/rails/rails/commit/0e6cf8faa89caf4c64311d35ca2bc88c1458d4e3 + - https://github.com/rails/rails/security/advisories/GHSA-x6mj-8jx9-qhqv +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml b/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml new file mode 100644 index 0000000000..0b3a7a5125 --- /dev/null +++ b/gems/actionview/GHSA-2p2f-4rq4-gjwc.yml @@ -0,0 +1,67 @@ +--- +gem: actionview +framework: rails +ghsa: 2p2f-4rq4-gjwc +url: https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc +title: "Possible XSS vulnerability in Action View text helpers" +date: 2026-11-04 +description: | + ### Impact + + With the HTML5 sanitizer (`Rails::HTML5::Sanitizer`, the default vendor on + CRuby for applications using `load_defaults 7.1` or later), Nokogiri before + 1.19.5 serializes `<` and `>` unescaped inside attribute values. The Action + View text helpers `highlight` and `simple_format` sanitize their input and + then process the resulting HTML as a string: `highlight` splits it on tag + boundaries to insert matches, and `simple_format` splits it into paragraphs on + blank lines. An unescaped `>` or a blank line inside an attribute value could + cause markup in that value, which the sanitizer left inert, to be emitted as + live elements in the helper's `html_safe` output, possibly leading to XSS. + Applications that use the HTML5 sanitizer and pass untrusted text to + `highlight`, or to `simple_format` with `html_options`, are affected. + + ### Details + + The fixed releases require rails-html-sanitizer 1.7.2 or later, which requires + Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer + escapes `<` and `>` in attribute values as `<` and `>`, as the HTML4 + sanitizer already does. The parsed DOM is unchanged, but code or tests that + compare sanitized HTML as a string may see the new serialization. + + ### Workarounds + + Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, + so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by + setting `config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch + - 8.0: + https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [azaran](https://hackerone.com/azaran). + This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0). +cvss_v3: 6.1 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionview/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionview/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73 + - https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11 + - https://github.com/rails/rails/security/advisories/GHSA-2p2f-4rq4-gjwc +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionview/GHSA-68p9-83h6-5wpj.yml b/gems/actionview/GHSA-68p9-83h6-5wpj.yml new file mode 100644 index 0000000000..4ef8e96612 --- /dev/null +++ b/gems/actionview/GHSA-68p9-83h6-5wpj.yml @@ -0,0 +1,53 @@ +--- +gem: actionview +framework: rails +ghsa: 68p9-83h6-5wpj +url: https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj +title: "Possible XSS vulnerability in Action View tag helpers" +date: 2026-11-04 +description: | + ### Impact + + The fix for + [CVE-2026-33168](https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq) + skips blank HTML attribute names in Action View tag helpers, but it tests the + name before converting it to a string. A Symbol name made only of whitespace, + such as `:" "`, is not blank, because `Symbol#blank?` is `Symbol#empty?`, so + it reaches the attribute escaping, which emits an attribute with no name and + produces malformed HTML. The asset tag helpers, such as `image_tag`, + `video_tag` and `audio_tag`, symbolize their options, so a whitespace String + name passed to them takes the same path. A carefully crafted attribute value + could then be misinterpreted by the browser as a separate attribute name, + possibly leading to XSS. Applications that allow users to specify custom HTML + attribute names are affected. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8.patch + - 8.0: + https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [thepo1es](https://hackerone.com/thepo1es). +cvss_v3: 4.7 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionview/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionview/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/9190210606ffe52f92fdc75637f8ff69404f22c8 + - https://github.com/rails/rails/commit/f47452533e1f28d847c63181b9d5f8b7243ef9a4 + - https://github.com/rails/rails/security/advisories/GHSA-68p9-83h6-5wpj +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionview/GHSA-rq8q-p985-fjq7.yml b/gems/actionview/GHSA-rq8q-p985-fjq7.yml new file mode 100644 index 0000000000..272b891205 --- /dev/null +++ b/gems/actionview/GHSA-rq8q-p985-fjq7.yml @@ -0,0 +1,63 @@ +--- +gem: actionview +framework: rails +ghsa: rq8q-p985-fjq7 +url: https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7 +title: "Possible XSS vulnerability in Action View strip_tags" +date: 2026-11-04 +description: | + ### Impact + + `strip_tags` in Action View returns its sanitized output marked `html_safe`, + but the underlying sanitizer encodes only `&`, `<` and `>`, leaving `"` and + `'` unencoded. Because ERB does not escape a string marked `html_safe`, + untrusted input passed through `strip_tags` and rendered inside a quoted HTML + attribute value could close the attribute and add new attributes, possibly + leading to XSS. Applications that render `strip_tags` output from untrusted + input inside an HTML attribute, for example in a `title` attribute or a + `` tag, are affected. Output rendered as element content is not + affected. + + ### Details + + `strip_tags` now encodes `"` and `'` in its output, as well as `&`, `<` and + `>`, without double-encoding existing entities. Applications that use + `strip_tags` output outside HTML, such as in a text template or JSON, now see + `"` and `'` where they saw `"` and `'`; `CGI.unescapeHTML` decodes + them. See the Action View CHANGELOG. + + ### Workarounds + + Pass `strip_tags` output to an attribute through a tag helper, which escapes + attribute values, for example `tag.a(title: strip_tags(user_input))`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7.patch + - 8.0: + https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [lucasluitjes](https://hackerone.com/lucasluitjes). +cvss_v3: 6.1 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionview/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionview/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/568b19cb860322885593e308a7f27aceb779e9d7 + - https://github.com/rails/rails/commit/c3772a10f405f9644125cbb484adfd2aa7a25a59 + - https://github.com/rails/rails/security/advisories/GHSA-rq8q-p985-fjq7 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/actionview/GHSA-v6rj-xm57-3p59.yml b/gems/actionview/GHSA-v6rj-xm57-3p59.yml new file mode 100644 index 0000000000..38f1cf82f5 --- /dev/null +++ b/gems/actionview/GHSA-v6rj-xm57-3p59.yml @@ -0,0 +1,67 @@ +--- +gem: actionview +framework: rails +ghsa: v6rj-xm57-3p59 +url: https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59 +title: "Possible XSS vulnerability in Action View highlight helper" +date: 2026-11-04 +description: | + ### Impact + + `ActionView::Helpers::TextHelper#highlight` substitutes each matched phrase + into the `:highlighter` string without escaping it and returns the result + marked HTML-safe. Because sanitizing leaves quote characters in text + unescaped, a match substituted into a quoted attribute value of the + highlighter, such as the `` form shown in the method's + documentation, could end the attribute value and add attributes to the + element, possibly leading to XSS. Applications are affected when they pass a + `:highlighter` that places a placeholder inside an attribute value and + highlight text or phrases that a user controls. The default `\1` + highlighter and the block form are not affected. + + ### Details + + The fixed releases HTML-escape each group substituted into the `:highlighter` + string, so quotes in a match are rendered as `"` and `'`. Only the + numbered placeholders `\0` to `\9` are expanded; other `String#sub` + replacement escapes, such as `\k`, `\&` and `\\`, are left as written. A + match can no longer begin on the `>` that closes a preceding tag. Escaping + makes a placeholder safe as element content or inside a quoted attribute + value, but not in an unquoted attribute value, a URL, JavaScript or CSS + context, or an attribute whose value is HTML. See the Action View CHANGELOG + for details. + + ### Workarounds + + Use a `:highlighter` that places the matched phrase only in element content, + such as the default `\1`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425.patch + - 8.0: + https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a.patch + + ### Credit + + This issue was found by the Anthropic OSS Scanner (ANT-2026-THHUJQVO). +cvss_v3: 6.1 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/actionview/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/actionview/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/06938194b4fd59e1d2c8ab4a781f3c1e2b763425 + - https://github.com/rails/rails/commit/c796f6198837479ada13290eb8fa767b5219a58a + - https://github.com/rails/rails/security/advisories/GHSA-v6rj-xm57-3p59 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml b/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml new file mode 100644 index 0000000000..63dddde7d9 --- /dev/null +++ b/gems/activestorage/GHSA-3f4q-8x5m-76v8.yml @@ -0,0 +1,71 @@ +--- +gem: activestorage +framework: rails +ghsa: 3f4q-8x5m-76v8 +url: https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8 +title: "Possible local file disclosure in Active Storage video previews and + analysis" +date: 2026-11-04 +description: | + ### Impact + + Active Storage's `VideoPreviewer`, `VideoAnalyzer` and `AudioAnalyzer` run + `ffmpeg` and `ffprobe` on a blob's contents without restricting the input + format, so FFmpeg selects a demuxer by probing the file. A blob created + through a direct upload keeps the content type the client declared, so a + client can store an HLS playlist under a `video/*` or `audio/*` type. When + that blob is previewed or analyzed, the `hls` demuxer opens the `file://` + segments that the playlist names, and the preview image or the stored metadata + could disclose a local media file that the application process can read and + whose path the attacker knows. + + Applications that accept uploads from untrusted users and generate video + previews, or analyze video or audio attachments with FFmpeg, are affected. + + ### Details + + The fixed releases limit the formats FFmpeg may open to common audio and video + containers, configured by the new + `config.active_storage.ffmpeg_allowed_formats` setting. Files in other formats + no longer preview or receive media metadata; the Active Storage CHANGELOG + names some of them and shows how to add a format to the list. + + ### Workarounds + + Applications that cannot upgrade can stop Active Storage from running FFmpeg + on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from + `config.active_storage.previewers`, and + `ActiveStorage::Analyzer::VideoAnalyzer` and + `ActiveStorage::Analyzer::AudioAnalyzer` from + `config.active_storage.analyzers`. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282.patch + - 8.0: + https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [w3rmut](https://hackerone.com/w3rmut). +cvss_v3: 3.7 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/3b1f2627538dc597cd973530c08514a26c2b0282 + - https://github.com/rails/rails/commit/69aff80d115bbb9d1e82fd6c6f2fd3ddeafb958b + - https://github.com/rails/rails/security/advisories/GHSA-3f4q-8x5m-76v8 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-3w93-6hmw-whh4.yml b/gems/activestorage/GHSA-3w93-6hmw-whh4.yml new file mode 100644 index 0000000000..b341979483 --- /dev/null +++ b/gems/activestorage/GHSA-3w93-6hmw-whh4.yml @@ -0,0 +1,72 @@ +--- +gem: activestorage +framework: rails +ghsa: 3w93-6hmw-whh4 +url: https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4 +title: "Unsigned Content-Type in Active Storage GCS direct uploads with + cache_control" +date: 2026-11-04 +description: | + ### Impact + + When a GCS service is configured with the `cache_control` option, + `ActiveStorage::Service::GCSService#url_for_direct_upload` signs direct-upload + URLs with V4, and the V4 signature covers only the `Cache-Control` and `Host` + headers. A direct-upload client can therefore send a `Content-Type` of its + choosing, and can omit the declared `Content-MD5`, without invalidating the + URL. GCS stores the supplied content type as object metadata, which takes + precedence over the `response-content-type` that Active Storage sets on + download URLs, so an uploaded object could be served as inline HTML under the + application's bucket path on `storage.googleapis.com`. Script in such an + object runs on the storage origin rather than the application's, but could + register a Service Worker scoped to the bucket path and read or replace a + victim's later responses for signed URLs in that bucket. + + Applications that use the GCS service with `cache_control` configured and + accept direct uploads are affected. GCS services without `cache_control` sign + with V2 and are not affected. + + ### Details + + The fixed releases sign every GCS direct-upload URL with V2, which binds an + empty `Content-Type` and the declared `Content-MD5`. The configured + `Cache-Control` is still returned by `headers_for_direct_upload` and sent by + the client, but it is no longer part of the signature, and direct-upload URLs + for these services are no longer limited to V4's seven-day maximum expiry. See + the Active Storage CHANGELOG. + + ### Workarounds + + Removing the `cache_control` option from the GCS service configuration makes + Active Storage sign direct uploads with V2. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1.patch + - 8.0: + https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [thepo1es](https://hackerone.com/thepo1es). +cvss_v3: 4.7 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/8d93f6a872e9550a91bf0e4fce50083a235ef3b1 + - https://github.com/rails/rails/commit/ddc08ba61a8001e7402864c62e466cf732fc7614 + - https://github.com/rails/rails/security/advisories/GHSA-3w93-6hmw-whh4 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml b/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml new file mode 100644 index 0000000000..7a27de1b07 --- /dev/null +++ b/gems/activestorage/GHSA-4v2w-w6g6-f8f8.yml @@ -0,0 +1,67 @@ +--- +gem: activestorage +framework: rails +ghsa: 4v2w-w6g6-f8f8 +url: https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8 +title: "Possible DoS vulnerability in Active Storage proxy mode via storage + errors during streaming" +date: 2026-11-04 +description: | + ### Impact + + When Active Storage serves a file through its proxy controllers, + `ActiveStorage::Streaming#send_blob_stream` handles an error from the storage + service by calling `head` to send a 404 or 500 response. If the error occurs + after the first chunk has been written, the response is already committed, and + `head` replaces the response body while the server is still reading the + original `ActionController::Live` buffer. That buffer is never closed, so the + server thread handling the request blocks until the process restarts. Repeated + failed downloads could exhaust the server's threads, possibly resulting in a + DoS vulnerability. + + Applications are affected when they store files on a service that streams a + download in several requests, such as Amazon S3, an S3-compatible service or + Google Cloud Storage, and draw Active Storage's default routes. The proxy + routes are drawn whether or not proxy mode is the default for the application. + A file deleted while it is being served, or any other storage error partway + through a download, triggers the condition. + + ### Details + + A storage error raised before the response is committed still produces a 404 + or 500 response. After the fix, a storage error raised after the response is + committed is re-raised instead, so the server closes the streamed response and + releases the thread; the client receives a truncated body, and the exception + reaches the application's error reporting. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009.patch + - 8.0: + https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82.patch + + ### Credit + + This issue was found by the Anthropic OSS Scanner (ANT-2026-FMPUMYTB). +cvss_v3: 5.3 +unaffected_versions: + - "< 8.0.0" +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/3c67a693fb21870ecb1222e3da59d5c491a62009 + - https://github.com/rails/rails/commit/655b4442de136a3701334607f634d698bf9d5b82 + - https://github.com/rails/rails/security/advisories/GHSA-4v2w-w6g6-f8f8 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-f3w6-w445-fwh9.yml b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml new file mode 100644 index 0000000000..068a5dccdb --- /dev/null +++ b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml @@ -0,0 +1,121 @@ +--- +gem: activestorage +framework: rails +ghsa: f3w6-w445-fwh9 +url: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 +title: "Possible arbitrary file write and read in Active Storage image analysis" +date: 2026-11-04 +description: | + ### Impact + + A Rails application that processes attachments with ImageMagick may allow an + unauthenticated attacker to write arbitrary files on the server and, when + attachments are stored with the Disk service, to read arbitrary files readable + by the application process. Those files typically include `secret_key_base` + and credentials for external systems, which may in turn allow escalation to + remote code execution or lateral movement to those systems. + + ### Details + + ImageMagick selects a coder from the content of the file it is given, and some + coders act on files named inside the image rather than on the image itself. + Active Storage constrained none of ImageMagick's coders, and the ImageMagick + analyzer runs when a file is attached, so an attacker who can upload a crafted + file may be able to invoke one. Attaching the upload is sufficient; no + variant, preview, or `analyze` call is required. One specific attack chain has + been reported to us, but we do not assume it is the only one that exists. + + The fixed versions ship an ImageMagick security policy and prepend its + directory to `MAGICK_CONFIGURE_PATH` through `MiniMagick.cli_env`, so every + ImageMagick process that MiniMagick spawns applies it. The policy denies the + `MSL` scripting coder, the coders that read or delete files other than the + image, fetch remote or local references, or display to a screen, every coder + backed by Ghostscript together with the `gs` delegate, and `@filename` + indirection. ImageMagick applies every `policy.xml` on its search path, so the + shipped policy adds to the host's policy rather than replacing it. The policy + applies to every ImageMagick command that MiniMagick runs, not only those of + Active Storage. See the `activestorage` CHANGELOG and "ImageMagick Security + Policy" in the Active Storage guide. + + ### Affected applications + + An application is affected if it meets all of these requirements: + - Uses ImageMagick for Active Storage image processing. This is + `config.active_storage.variant_processor = :mini_magick`, which is the + default for applications on `load_defaults 6.1` or earlier. + - Runs ImageMagick under a security policy that does not already deny the + coders involved. The policies that Debian and Ubuntu package do not. + - Allows file uploads from untrusted users. + + ### Mitigation + + - Upgrade to a fixed version of `activestorage`. + - An application whose variant processor is `:mini_magick` must use + mini_magick `>= 5.1`, which applying the policy requires. With an older + mini_magick, such an application raises an exception during boot. + - An application that renders PostScript or PDF through ImageMagick must + re-allow the `gs` delegate and the coders it uses in the host's + `policy.xml`. + - An application that replaces `MiniMagick.cli_env` after boot, clears the + environment with `MiniMagick.cli_prefix`, or installs its own + `MiniMagick::Shell` does not receive the shipped policy and must carry its + rules in ImageMagick's system policy. GraphicsMagick does not read + ImageMagick policies. + - If attachments are stored with the Disk service, change `secret_key_base` + and every secret readable by the application process, including the master + key and everything `config/credentials.yml.enc` holds, storage and database + credentials, and third-party tokens. Do not retain an exposed secret as a + fallback. + + ### Workarounds + + Copy the rules of the policy that the fixed versions ship, + `activestorage/lib/active_storage/image_magick/policy.xml`, into ImageMagick's + system policy, for example `/etc/ImageMagick-7/policy.xml`. At a minimum, deny + the `MSL` coder, the Ghostscript coders, and the `gs` delegate: + + ```xml + + + + ``` + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328 + - 8.0: + https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776 + + ### Versions affected + + - activestorage < 8.0.5.2 + - activestorage >= 8.1, < 8.1.4.1 + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [ryotak](https://hackerone.com/ryotak). + + ### References + + - ImageMagick [security policy](https://imagemagick.org/security-policy/) +cvss_v3: 9.8 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328 + - https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776 + - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml b/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml new file mode 100644 index 0000000000..efba5b37fd --- /dev/null +++ b/gems/activestorage/GHSA-hfr4-8rjc-97m2.yml @@ -0,0 +1,63 @@ +--- +gem: activestorage +framework: rails +ghsa: hfr4-8rjc-97m2 +url: https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2 +title: "Possible circumvention of file size limits in Active Storage direct + uploads to Google Cloud Storage" +date: 2026-11-04 +description: | + ### Impact + + `ActiveStorage::Service::GCSService#url_for_direct_upload` does not bind the + declared content length into the signed direct-upload URL, and + `#headers_for_direct_upload` returns no length constraint, so the URL + authorizes an upload body of any size. A direct-upload client could store a + file larger than the `byte_size` it declared, and the resulting blob keeps the + declared size, possibly bypassing application file size validations and + quotas. This is the weakness that CVE-2020-8162 fixed in the S3 service. + + Applications that store files in Google Cloud Storage and accept direct + uploads are affected. + + ### Details + + The fixed releases sign an `x-goog-content-length-range` header that matches + the blob's declared `byte_size` and return it from + `headers_for_direct_upload`, so Cloud Storage rejects an upload body of any + other size. Browsers send this header with the direct upload, so a bucket's + CORS configuration must list `x-goog-content-length-range` in + `responseHeader`, or browser direct uploads fail after the upgrade. The Active + Storage CHANGELOG and the CORS example in the Active Storage guide show the + change. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7.patch + - 8.0: + https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [f4cts](https://hackerone.com/f4cts). +cvss_v3: 5.3 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/e19916cea31cbfb0030b165ae853b741f8dd57a7 + - https://github.com/rails/rails/commit/7fe85a72a789eae5ee070ce3ee1dad10a8a5f70c + - https://github.com/rails/rails/security/advisories/GHSA-hfr4-8rjc-97m2 +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml b/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml new file mode 100644 index 0000000000..9e512548a3 --- /dev/null +++ b/gems/activestorage/GHSA-p2pm-g2h6-7j5j.yml @@ -0,0 +1,62 @@ +--- +gem: activestorage +framework: rails +ghsa: p2pm-g2h6-7j5j +url: https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j +title: "Possible DoS vulnerability in Active Storage filename handling" +date: 2026-11-04 +description: | + ### Impact + + `ActiveStorage::Filename#base` and `#extension_with_delimiter`, and therefore + `#extension`, pass the stored filename unmodified to `File.basename` and + `File.extname`, which raise `ArgumentError` when the name contains a NUL byte. + Active Storage stores the client-supplied filename verbatim, so a user who is + permitted to upload an attachment could persist such a filename on databases + that accept NUL bytes in string columns, such as SQLite and MySQL/MariaDB. + Each subsequent request that builds a variant or preview of the blob, opens + it, or renders it as an Action Text attachment then raises, possibly resulting + in a persistent DoS vulnerability for the pages that display the blob until it + is purged or its filename is corrected. Applications that use PostgreSQL are + not affected, because PostgreSQL rejects the row. + + ### Details + + `Filename#base` and `#extension_with_delimiter` now derive from + `Filename#sanitized`, the form that `Filename#to_s` and the + `Content-Disposition` header already use. For a filename that `#sanitized` + changes, such as one containing a NUL byte, an invalid byte sequence, a path + separator or another replaced character, the base and extension now agree with + `#to_s`; the variant format inferred from such a name may change, and an + existing variant may be regenerated once. Stored filenames are not modified, + and no data migration is required. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692.patch + - 8.0: + https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a.patch + + ### Credit + + This issue was found by the Anthropic OSS Scanner (ANT-2026-UQM5Z4YL). +cvss_v3: 4.3 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/60f22af88b71eae251f112d8c0237a08a8832692 + - https://github.com/rails/rails/commit/9b0d4bef2211a2c08cab2e0ea17fa1d0efd5d47a + - https://github.com/rails/rails/security/advisories/GHSA-p2pm-g2h6-7j5j +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activestorage/GHSA-v924-7rp8-4mxh.yml b/gems/activestorage/GHSA-v924-7rp8-4mxh.yml new file mode 100644 index 0000000000..51e8c56c66 --- /dev/null +++ b/gems/activestorage/GHSA-v924-7rp8-4mxh.yml @@ -0,0 +1,111 @@ +--- +gem: activestorage +framework: rails +ghsa: v924-7rp8-4mxh +url: https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh +title: "Possible arbitrary file read and remote code execution in Active + Storage video previews, analysis and image processing" +date: 2026-11-04 +description: | + ### Impact + + `ActiveStorage::Blob#open` writes a blob to a tempfile whose name carries the + extension of the uploaded filename, and hands that path to `ffprobe` + (`VideoAnalyzer`, `AudioAnalyzer`), `ffmpeg` (`VideoPreviewer`) and + ImageMagick (`ImageAnalyzer`, the `:mini_magick` variant processor). These + tools select a decoder from the file extension when the content does not + identify its own format, so an attacker who chooses the filename and declares + the content type of an upload chooses which decoder processes it. An FFmpeg + built with AviSynth support treats a file with the `.avs` extension as an + AviSynth script and evaluates it, which could disclose files readable by the + application process through the preview image, or load a native library the + attacker has also uploaded, possibly leading to remote code execution in the + FFmpeg process. ImageMagick selects its coders and delegates from the + extension in the same way. + + ### Details + + The fixed releases keep the uploaded extension on the tempfile only when + Marcel maps that extension to the blob's recorded content type, and name the + tempfile with no extension otherwise. A form upload whose Rack tempfile fails + the same check is copied to a correctly named tempfile before processing. + Files whose uploaded extension disagrees with their content type are still + processed; the external tool detects their format from the content. The Active + Storage CHANGELOG describes the change. + + ### Affected applications + + An application is affected if it meets all of these requirements: + - Accepts uploads from untrusted users. + - Analyzes video or audio attachments (which Active Storage does on attach by + default), generates video previews, or processes images with ImageMagick. + + The AviSynth attack additionally requires an FFmpeg built with + `--enable-avisynth` and the AviSynthPlus runtime on the host. Upstream FFmpeg + and the common Linux distribution and Homebrew packages do not enable it; the + GPL builds distributed for Windows and Linux from ffmpeg.org do. Other + decoders that FFmpeg or ImageMagick select from the extension may be reachable + without AviSynth. + + ### Mitigation + + - Upgrade to a fixed version of `activestorage`. + + ### Expire and change secrets + + Upgrading closes the vulnerability but does not undo a disclosure that already + occurred. An application that meets the AviSynth requirement above should + treat every secret readable by the application process as potentially exposed + and change it, including `secret_key_base`, the master key and everything in + `config/credentials.yml.enc` that it decrypts, the Active Storage service + credentials, database credentials, and tokens for third-party services. + Changing `secret_key_base` expires active sessions and invalidates signed and + encrypted cookies, signed global IDs and Active Storage URLs. Do not retain an + exposed secret as a fallback. + + ### Workarounds + + Applications that cannot upgrade can stop Active Storage from running FFmpeg + on uploaded files by removing `ActiveStorage::Previewer::VideoPreviewer` from + `config.active_storage.previewers`, and + `ActiveStorage::Analyzer::VideoAnalyzer` and + `ActiveStorage::Analyzer::AudioAnalyzer` from + `config.active_storage.analyzers`. Running an FFmpeg built without AviSynth + support closes the AviSynth attack but not the extension-selected decoders of + ImageMagick. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e.patch + - 8.0: + https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636.patch + + ### Versions affected + + - activestorage < 8.0.5.2 + - activestorage >= 8.1, < 8.1.4.1 + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [pirikara](https://hackerone.com/pirikara). +cvss_v3: 8.8 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/72136ff39153bc8d63ecbc899993848eb3d6573e + - https://github.com/rails/rails/commit/8106938fb0a595f11006dd1497cd409e27d7d636 + - https://github.com/rails/rails/security/advisories/GHSA-v924-7rp8-4mxh +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml b/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml new file mode 100644 index 0000000000..3c52033811 --- /dev/null +++ b/gems/activesupport/GHSA-2w9f-fxwj-w2qf.yml @@ -0,0 +1,65 @@ +--- +gem: activesupport +framework: rails +ghsa: 2w9f-fxwj-w2qf +url: https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf +title: "Possible XSS vulnerability in Active Support MessagePack serializer" +date: 2026-11-04 +description: | + ### Impact + + `ActiveSupport::MessagePack` serializes an `ActiveSupport::SafeBuffer` as its + bytes alone and deserializes it as a new `SafeBuffer`, so a buffer that is no + longer `html_safe?` (for example, one mutated in place with `gsub!`) is + restored as `html_safe`. If such a buffer holds untrusted input and is stored + through a MessagePack serializer, rendering it after it is loaded bypasses ERB + auto-escaping, possibly leading to XSS. + + Applications on Rails 8.1 are affected if they use a MessagePack serializer, + such as `config.action_dispatch.cookies_serializer = :message_pack` or + `:message_pack_allow_marshal`, or `serializer: :message_pack` for + `Rails.cache`, `ActiveSupport::MessageVerifier` or + `ActiveSupport::MessageEncryptor`, and store a `SafeBuffer` that was mutated + in place with untrusted input. Rails 8.0 and earlier do not serialize + `SafeBuffer` with MessagePack and are not affected. + + ### Details + + The fixed releases serialize a `SafeBuffer` that is not `html_safe?` with a + marker and deserialize it as a `String`; a `SafeBuffer` that is `html_safe?` + keeps the existing format. Versions without the fix cannot read an unsafe + buffer serialized by the fixed releases, so during a rolling deploy a cookie + or cache entry holding one could fail to load on a process that has not been + upgraded. + + ### Workarounds + + Applications that cannot upgrade can convert a `SafeBuffer` to a `String` with + `to_str` before storing it in a value that a MessagePack serializer writes. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7.patch + + ### Credit + + This issue was responsibly reported by HackerOne researcher + [jcwilk](https://hackerone.com/jcwilk). +cvss_v3: 4.7 +unaffected_versions: + - "< 8.1.0" +patched_versions: + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activesupport/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://github.com/rails/rails/commit/4ca090665976e6fbc471c38689b399f84b43cdc7 + - https://github.com/rails/rails/security/advisories/GHSA-2w9f-fxwj-w2qf +notes: | + - No CVE. + - cvss_v3 from GHSA diff --git a/gems/activesupport/GHSA-8474-xrp6-wh69.yml b/gems/activesupport/GHSA-8474-xrp6-wh69.yml new file mode 100644 index 0000000000..4170d0fd5e --- /dev/null +++ b/gems/activesupport/GHSA-8474-xrp6-wh69.yml @@ -0,0 +1,88 @@ +--- +gem: activesupport +framework: rails +ghsa: 8474-xrp6-wh69 +url: https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69 +title: "Possible DoS vulnerability in Active Support safe_constantize" +date: 2026-11-04 +description: | + ### Impact + + When constant lookup raises `LoadError`, + `ActiveSupport::Inflector#safe_constantize` (and `String#safe_constantize`) + builds a regular expression from the requested constant name without escaping + it, so a caller that passes untrusted input lets the attacker choose the + source of a pattern that the application compiles. Crafted patterns can + trigger defects in Ruby's regular expression compiler, possibly leading to a + crash of the server process, and repeated requests could keep the application + unavailable. + + Action Cable passes the `channel` value of each `subscribe` command to + `safe_constantize` before any channel lookup, so in the default configuration + an unauthenticated client of the Action Cable endpoint can reach this code. + + ### Details + + The check that decides whether `safe_constantize` returns `nil` or re-raises + the `LoadError` now matches the first segment of the constant name against the + error message as a literal string, and no longer compiles a regular + expression. It returns the same result as before for constant names that + contain no regular expression syntax. + + ### Affected applications + + An application is affected if it meets all of these requirements: + - Mounts Action Cable, which a new Rails application does by default at + `/cable` (`config.action_cable.mount_path`), or otherwise passes untrusted + input to `safe_constantize`. + - Accepts Action Cable connections from untrusted clients. + `ApplicationCable::Connection#connect` authenticates nobody unless the + application adds a check. + + ### Workarounds + + Applications that do not use Action Cable can set + `config.action_cable.mount_path = nil` to remove the endpoint. Applications + that use Action Cable can call `reject_unauthorized_connection` in + `ApplicationCable::Connection#connect` for unauthenticated clients, which + limits exposure to authenticated users but does not remove it. + + ### Releases + + The fixed releases are available at the normal locations. + + Patches for those who cannot upgrade at once: + - 8.1: + https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb.patch + - 8.0: + https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20.patch + + ### Versions affected + + - activesupport < 8.0.5.2 + - activesupport >= 8.1, < 8.1.4.1 + + ### Credit + + This issue was responsibly reported by Felix Tscheulin + ([flixt](https://hackerone.com/flixt)) through HackerOne researcher + [scheja](https://hackerone.com/scheja), and independently by Bucky Wolfe + ([Igneous](https://github.com/Igneous)), who provided a proof of concept that + crashes the server. It was also found by the Anthropic OSS Scanner + (ANT-2026-ZUN5KU3Q). +cvss_v3: 7.5 +patched_versions: + - "~> 8.0.5, >= 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://rubygems.org/gems/activesupport/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activesupport/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/commit/95aa9e416016524956d4904fed96eaed079580bb + - https://github.com/rails/rails/commit/210ac22d446c8e2625b091e79256806b836eee20 + - https://github.com/rails/rails/security/advisories/GHSA-8474-xrp6-wh69 +notes: | + - No CVE. + - cvss_v3 from GHSA