bad PR

gems/activestorage/CVE-2026-122006.yml

@@ -0,0 +1,38 @@
+---
+gem: activestorage
+framework: rails
+cve: 2026-122006
+ghsa: wgv4-95jc-33jm
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-122006
+title: Possible arbitrary file write and read in Active Storage image analysis
+date: 2026-11-04
+description: |
+  ## Impact
+
+  A Rails application that processes attachments with ImageMagick may
+  allow an unauthenticated attacker to write arbitrary files on the
+  server and, when attachments are stored with the Disk service, to
+  read arbitrary files readable by the application process. Those files
+  typically include secret_key_base and credentials for external
+  systems, which may in turn allow escalation to remote code execution
+  or lateral movement to those systems.
+
+  ## Credit
+
+  This issue was responsibly reported by HackerOne researcher ryotak.
+cvss_v3: 9.8
+patched_versions:
+  - "~> 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-122006
+    - https://rubygems.org/gems/activestorage/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/activestorage/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9
+    - https://github.com/advisories/GHSA-wgv4-95jc-33jm
+notes: |
+  - CVE from GHSA URL.
+  - cvss_v3 from GHSA URL.

gems/rodauth/CVE-2026-82466.yml

@@ -0,0 +1,33 @@
+---
+gem: rodauth
+cve: 2026-82466
+ghsa: 3pvr-v35r-4r75
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-82466
+title: Account takeover in webauthn_login feature
+date: 2026-08-18
+description: |
+  ## Impact
+
+  If the webauth_login feature is not enabled (the default), there
+  is no impact.
+
+  If the webauthn_login feature is enabled and the already_logged_in
+  configuration method is not used to halt or redirect, then any user
+  can login as any other user, by accessing the webauthn login page
+  while already logged in.
+cvss_v3: 8.7
+cvss_v4: 9.4
+patched_versions:
+  - ">= 2.46.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-82466
+    - https://rubygems.org/gems/rodauth/versions/2.46.0
+    - https://github.com/jeremyevans/rodauth/discussions/513
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_46_0_txt.html
+    - https://github.com/jeremyevans/rodauth/commit/35d74a9f07b2005a8ea75fc11a6539c04f3c2840
+    - https://www.vulncheck.com/advisories/rodauth-before-2.46.0-authentication-bypass-via-webauthn-login
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-3pvr-v35r-4r75
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from nvd.nist.gov and GHSA URLs.

gems/rodauth/GHSA-26qw-xq5q-hv9w.yml

@@ -0,0 +1,30 @@
+---
+gem: rodauth
+ghsa: 26qw-xq5q-hv9w
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-26qw-xq5q-hv9w
+title: otp feature allows replay of OTP code for
+   a later time step accepted due to drift
+date: 2026-11-02
+description: |
+  The fix for GHSA-hhvg-6qmv-58vc does not cover OTP codes for a later
+  time step accepted due to otp_drift. Such a code can be reused
+  once the 30 second check in otp_update_last_use passes.
+
+  ## Impact
+
+  Replay of an already used OTP code (CWE-294) with the default otp_drift.
+  Exploiting it requires the password and a used code for a later time
+  step than the server's (from an authenticator whose clock was ahead),
+  replayed starting 30 seconds after its use (for 30 to 60 seconds).
+  Setting otp_drift nil avoids it.
+cvss_v4: 2.1
+patched_versions:
+  - ">= 2.50.0"
+related:
+  url:
+    - https://rubygems.org/gems/rodauth/versions/2.50.0
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_50_0_txt.html
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-26qw-xq5q-hv9w
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from GHSA URL.

gems/rodauth/GHSA-h9m4-vm9w-h43m.yml

@@ -0,0 +1,41 @@
+---
+gem: rodauth
+ghsa: h9m4-vm9w-h43m
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
+title: Return to path support allows redirects to remote
+   protocol-relative URLs
+date: 2026-08-24
+description: |
+  ## Impact
+
+  If you are not using the confirm_password feature and you are not
+  using the login_return_to_requested_location? or
+  two_factor_auth_return_to_requested_location? configuration methods
+  (the default), there is no impact.
+
+  If you are using the confirm_password feature or you are using the
+  login_return_to_requested_location? or
+  two_factor_auth_return_to_requested_location? configuration methods,
+  an attacker who can convince a user to access a path of the attacker's
+  choosing on the application using Rodauth can get Rodauth to redirect
+  to an attacker-chosen protocol-relative URL after completing the
+  action (such as logging in, performing two factor authentication,
+  or confirming their password). Whether this protocol-relative URL
+  will be redirected to depends on factors such as the user's browser.
+
+  This does not allow the attacker any access to the application, but
+  it can result in difficult to detect phishing attempts, where the
+  user ends up on an attacker controlled website after going through
+  a legitimate authentication flow in the application using Rodauth.
+cvss_v4: 4.9
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-h9m4-vm9w-h43m
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from GHSA URL.

gems/rodauth/GHSA-hh2f-xw94-5p79.yml

@@ -0,0 +1,42 @@
+---
+gem: rodauth
+ghsa: hh2f-xw94-5p79
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79
+title: CSRF bypass using content-type parameter
+date: 2026-08-24
+description: |
+  ## Impact
+
+  If you are not using the json feature (the default) or you are using
+  the json_request_content_type_regexp configuration method with an
+  appropriate anchor (e.g. \A), or use are using the jwt feature with
+  default use_jwt? setting, there is no impact.
+
+  If you are using the json feature, are not setting a
+  json_request_content_type_regexp to use an appropriate anchor, and
+  are not using the jwt feature (or are using it but using also use_jwt?
+  to allow non-JWT JSON requests), then Rodauth could be vulnerable
+  to requests that bypass CSRF protection and CORS preflighting.
+
+  To be vulnerable to this affecting an authenticated session, this
+  requires that the session cookie does not enforce SameSite restrictions.
+  With the recommended sessions implementation (Roda session plugin)
+  and most modern session implementations, SameSite=Lax is used by
+  default, so the attacker-controlled site must be same-site-cross-origin,
+  significantly limiting the attack radius. However, this vulnerability
+  can be used from other locations to force a user login into an
+  attacker-controlled account (if the already_logged_in configuration
+  method is set to halt or redirect, this can only be done for
+  unauthenticated sessions).
+cvss_v4: 4.9
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-hh2f-xw94-5p79
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from GHSA URL.

gems/rodauth/GHSA-w4fg-qf56-62m2.yml

@@ -0,0 +1,36 @@
+---
+gem: rodauth
+ghsa: w4fg-qf56-62m2
+url: https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2
+title: jwt_refresh route doesn't require refresh token to
+  create new access token
+date: 2026-08-27
+description: |
+  ## Impact
+
+  If you are not using the jwt_refresh feature, there is no impact.
+
+  If you are using the jwt_refresh feature, and are setting
+  allow_refresh_with_expired_jwt_access_token? true in your Rodauth
+  configuration, and an attacker gets access to a expired access token,
+  they can use that expired access token to create valid access tokens
+  without access to a valid access token or valid refresh token.
+
+  Note that without allow_refresh_with_expired_jwt_access_token? true
+  being set, if the attacker gets access to a valid access token, they
+  can use that valid access token to create additional valid access
+  tokens without access to a valid refresh token. They would allow
+  an attacker to convert temporary access to an account into permanent
+  access, until there was a token clearing event for the account.
+cvss_v4: 5.1
+patched_versions:
+  - ">= 2.47.0"
+related:
+  url:
+    - https://rubygems.org/gems/rodauth/versions/2.47.0
+    - https://github.com/jeremyevans/rodauth/discussions/514
+    - https://rodauth.jeremyevans.net/rdoc/files/doc/release_notes/2_47_0_txt.html
+    - https://github.com/jeremyevans/rodauth/security/advisories/GHSA-w4fg-qf56-62m2
+notes: |
+  - No CVE from GHSA URL.
+  - cvss_v4 from GHSA URL.