From eedcc2393abb938e21e670e617d476fa11dda83f Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Wed, 4 Nov 2026 16:02:53 -0500 Subject: [PATCH 1/3] One new activestorage advisory --- gems/activestorage/CVE-2026-122006.yml | 30 ++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 gems/activestorage/CVE-2026-122006.yml diff --git a/gems/activestorage/CVE-2026-122006.yml b/gems/activestorage/CVE-2026-122006.yml new file mode 100644 index 0000000000..2c199e8fdc --- /dev/null +++ b/gems/activestorage/CVE-2026-122006.yml @@ -0,0 +1,30 @@ +--- +gem: activestorage +framework: rails +cve: 2026-122006 +ghsa: wgv4-95jc-33jm +url: https://nvd.nist.gov/vuln/detail/CVE-2026-122006 +title: ActiveStorage ImageMagick Arbitrary File Access Vulnerability +date: 2026-11-04 +description: | + The activestorage gem before 8.1.4.1 for Ruby on Rails, when + ImageMagick attachment processing occurs, can allow server read + and write operations (e.g., reading secret_key_base) because the + ImageMagick analyzer runs when a file is attached, and there is + not an ImageMagick security policy to block unintended functionality. +cvss_v3: 9.8 +patched_versions: + - "~> 8.0.5.2" + - ">= 8.1.4.1" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-122006 + - https://rubygems.org/gems/activestorage/versions/8.1.4.1 + - https://github.com/rails/rails/releases/tag/v8.1.4.1 + - https://rubygems.org/gems/activestorage/versions/8.0.5.2 + - https://github.com/rails/rails/releases/tag/v8.0.5.2 + - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 + - https://github.com/advisories/GHSA-wgv4-95jc-33jm +notes: | + - CVE from GHSA URL. + - cvss_v3 from GHSA URL. From bb6190ed3fe6e0bef6e10dc31228d3db6284b91c Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 6 Nov 2026 11:27:38 -0500 Subject: [PATCH 2/3] Merged 2 advisories; deleted dup; Add dup to ignore file --- gems/activestorage/CVE-2026-122006.yml | 30 ---------------------- gems/activestorage/GHSA-f3w6-w445-fwh9.yml | 9 +++++-- lib/rad-ignores.sh | 3 +++ 3 files changed, 10 insertions(+), 32 deletions(-) delete mode 100644 gems/activestorage/CVE-2026-122006.yml diff --git a/gems/activestorage/CVE-2026-122006.yml b/gems/activestorage/CVE-2026-122006.yml deleted file mode 100644 index 2c199e8fdc..0000000000 --- a/gems/activestorage/CVE-2026-122006.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- -gem: activestorage -framework: rails -cve: 2026-122006 -ghsa: wgv4-95jc-33jm -url: https://nvd.nist.gov/vuln/detail/CVE-2026-122006 -title: ActiveStorage ImageMagick Arbitrary File Access Vulnerability -date: 2026-11-04 -description: | - The activestorage gem before 8.1.4.1 for Ruby on Rails, when - ImageMagick attachment processing occurs, can allow server read - and write operations (e.g., reading secret_key_base) because the - ImageMagick analyzer runs when a file is attached, and there is - not an ImageMagick security policy to block unintended functionality. -cvss_v3: 9.8 -patched_versions: - - "~> 8.0.5.2" - - ">= 8.1.4.1" -related: - url: - - https://nvd.nist.gov/vuln/detail/CVE-2026-122006 - - https://rubygems.org/gems/activestorage/versions/8.1.4.1 - - https://github.com/rails/rails/releases/tag/v8.1.4.1 - - https://rubygems.org/gems/activestorage/versions/8.0.5.2 - - https://github.com/rails/rails/releases/tag/v8.0.5.2 - - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 - - https://github.com/advisories/GHSA-wgv4-95jc-33jm -notes: | - - CVE from GHSA URL. - - cvss_v3 from GHSA URL. diff --git a/gems/activestorage/GHSA-f3w6-w445-fwh9.yml b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml index 068a5dccdb..790e347707 100644 --- a/gems/activestorage/GHSA-f3w6-w445-fwh9.yml +++ b/gems/activestorage/GHSA-f3w6-w445-fwh9.yml @@ -1,6 +1,7 @@ --- gem: activestorage framework: rails +cve: 2026-122006 ghsa: f3w6-w445-fwh9 url: https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 title: "Possible arbitrary file write and read in Active Storage image analysis" @@ -109,13 +110,17 @@ patched_versions: - ">= 8.1.4.1" related: url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-122006 - https://rubygems.org/gems/activestorage/versions/8.1.4.1 - https://github.com/rails/rails/releases/tag/v8.1.4.1 - https://rubygems.org/gems/activestorage/versions/8.0.5.2 - https://github.com/rails/rails/releases/tag/v8.0.5.2 - https://github.com/rails/rails/commit/468aa9a93fc98f5476b6821770f4ccfcb7f7d328 - https://github.com/rails/rails/commit/ea8c40121ce53a3d0255cd4eb6d13bfe3bc01776 + - https://github.com/advisories/GHSA-wgv4-95jc-33jm - https://github.com/rails/rails/security/advisories/GHSA-f3w6-w445-fwh9 + - https://github.com/advisories/GHSA-f3w6-w445-fwh9 notes: | - - No CVE. - - cvss_v3 from GHSA + - CVE from GHSA URL. + - cvss_v3 from GHSA URL. + - GHSA-wgv4-95jc-33jm appears to be a duplicate of GHSA-f3w6-w445-fwh9. diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index 2b9ce4e451..99e6d1f078 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -307,6 +307,9 @@ rm -f gems/shopify_app/CVE-2026-63414.yml \ gems/crass/CVE-2026-61847.yml \ gems/crass/CVE-2026-61848.yml +# 11/6/2026: GHSA-wgv4-95jc-33jm appears to be a dupliate of GHSA-f3w6-w445-fwh9. +rm -f gems/activestorage/CVE-2026-122006.yml + # 9/4/2026: More duplicates and withdrawns # nokogiri | https://github.com/advisories/GHSA-5jhf-fpp7-v2pv (duplicate) # nokogiri | https://github.com/advisories/GHSA-xqqh-3w52-q8p7 (duplicate) From 191e5119e1ad7dd0249f21b8d65adcb97c08179b Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 6 Nov 2026 11:35:23 -0500 Subject: [PATCH 3/3] Uprade GA python to 3.12 --- .github/workflows/ruby.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml index d83fbd9185..26cbe8b50a 100644 --- a/.github/workflows/ruby.yml +++ b/.github/workflows/ruby.yml @@ -36,7 +36,7 @@ jobs: - name: Set up Python uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 with: - python-version: 3.8 + python-version: 3.12 - name: Install yamllint run: | python -m pip install --upgrade pip