Skip to content

Commit d0ece16

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@5fdc4fb 
1 parent 2758cff commit d0ece16

9 files changed

Lines changed: 324 additions & 0 deletions

‎advisories/_posts/2023-10-23-CVE-2023-5590.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2023-5590 (selenium-webdriver): NULL Pointer Dereference in seleniumhq/selenium'
4+
comments: false
5+
categories:
6+
- selenium-webdriver
7+
advisory:
8+
gem: selenium-webdriver
9+
cve: 2023-5590
10+
ghsa: 4phc-fq33-39gx
11+
url: https://nvd.nist.gov/vuln/detail/CVE-2023-5590
12+
title: NULL Pointer Dereference in seleniumhq/selenium
13+
date: 2023-10-23
14+
description: |-
15+
This is a null pointer dereference that causes the IE driver to
16+
crash when selenium gets the cookies from an attacker controlled
17+
page. At a high level, the bug is caused by an insufficient check
18+
on data returned from Edge (Internet Explorer mode).
19+
cvss_v3: 7.5
20+
patched_versions:
21+
- ">= 4.14.0"
22+
related:
23+
url:
24+
- https://nvd.nist.gov/vuln/detail/CVE-2023-5590
25+
- https://rubygems.org/gems/selenium-webdriver/versions/4.14.0
26+
- https://github.com/SeleniumHQ/selenium/releases/tag/selenium-4.14.0
27+
- https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6
28+
- https://huntr.com/bounties/e268cd68-4f34-49bd-878b-82b96dcc0c99
29+
- https://github.com/advisories/GHSA-4phc-fq33-39gx
30+
notes: |
31+
- Found above commit string in 4.14 release list using "null" pattern.
32+
- cvss_v3 comes from GHSA.
33+
- date comes from release URL.
34+
- GHSA is unreviewed.
35+
---

‎advisories/_posts/2026-03-12-GHSA-qmpg-8xg6-ph5q.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,5 +42,6 @@ advisory:
4242
- https://github.com/basecamp/trix/releases/tag/v2.1.17
4343
- https://github.com/basecamp/trix/pull/1282
4444
- https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
45+
- https://hackerone.com/reports/3581911
4546
- https://github.com/advisories/GHSA-qmpg-8xg6-ph5q
4647
---

‎advisories/_posts/2026-04-13-CVE-2026-41316.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ advisory:
3333
related:
3434
url:
3535
- https://nvd.nist.gov/vuln/detail/CVE-2026-41316
36+
- https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released
3637
- https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released
3738
- https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
3839
- https://github.com/ruby/erb/blob/master/NEWS.md

‎advisories/_posts/2026-06-24-GHSA-6j52-38f8-qhxr.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-6j52-38f8-qhxr (shopify_app): Token exchange shop context confusion may
4+
allow cross-shop authorization bypass in affected apps'
5+
comments: false
6+
categories:
7+
- shopify_app
8+
advisory:
9+
gem: shopify_app
10+
ghsa: 6j52-38f8-qhxr
11+
url: https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
12+
title: Token exchange shop context confusion may allow cross-shop authorization
13+
bypass in affected apps
14+
date: 2026-06-24
15+
description: |-
16+
## Description
17+
18+
In token-exchange authenticated controllers, shopify_app exposes shop
19+
context through helpers such as current_shopify_domain. Prior to the
20+
fix, current_shopify_domain could resolve to the sanitized shop query
21+
parameter instead of the shop identity derived from the verified
22+
Shopify ID token or active Shopify session.
23+
24+
As a result, a request authenticated for one shop could include a
25+
different shop query parameter, causing application code to treat
26+
the requested shop as the current shop.
27+
28+
Applications that used current_shopify_domain, or the request shop
29+
parameter, for authorization decisions, tenant lookup, stored
30+
access-token selection, or shop-scoped data access may have been
31+
vulnerable to cross-shop context confusion.
32+
33+
The patched version hardens token-exchange handling so that:
34+
35+
* `current_shopify_domain` resolves to the authenticated shop from
36+
the verified token or session.
37+
* `authenticated_shopify_domain` exposes the trusted authenticated shop.
38+
* `requested_shopify_domain` exposes the sanitized requested shop
39+
parameter for bootstrap or routing use cases only.
40+
* Token-exchange requests are rejected with `401 Unauthorized` when
41+
the requested shop does not match the authenticated shop.
42+
unaffected_versions:
43+
- "< 22.1.0"
44+
patched_versions:
45+
- ">= 23.0.3"
46+
related:
47+
url:
48+
- https://rubygems.org/gems/shopify_app/versions/23.0.3
49+
- https://github.com/Shopify/shopify_app/blob/v23.0.3/CHANGELOG.md#2303-june-24-2026
50+
- https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
51+
- https://github.com/Shopify/shopify_app/pull/2081
52+
- https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
53+
notes: |
54+
- GHSA has "High" severity.
55+
- date from CHANGELOG.md
56+
- no CVE
57+
---

‎advisories/_posts/2026-07-15-CVE-2026-50276.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-50276 (datadog): dd-trace-rb - Improper parsing of W3C baggage headers
4+
may lead to DoS'
5+
comments: false
6+
categories:
7+
- datadog
8+
advisory:
9+
gem: datadog
10+
cve: 2026-50276
11+
ghsa: p5f6-rccc-jv98
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
13+
title: dd-trace-rb - Improper parsing of W3C baggage headers may lead to DoS
14+
date: 2026-07-15
15+
description: |-
16+
### Impact
17+
18+
Datadog tracing libraries that implement W3C baggage propagation parse
19+
incoming baggage HTTP headers without enforcing item-count or byte-size
20+
limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64)
21+
and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only
22+
to baggage injection, not extraction. A remote, unauthenticated attacker
23+
can send a request whose baggage header contains an arbitrarily large
24+
number of comma-separated key-value pairs (or a single very large value).
25+
The tracer allocates a hash-map entry for each pair on every request,
26+
causing unbounded CPU and memory consumption and enabling a remote
27+
Denial of Service against any HTTP service that has the baggage
28+
propagation style enabled.
29+
The baggage propagation style is enabled by default in most affected
30+
tracers, so any internet-facing service that has been instrumented
31+
with an affected tracer version is exposed unless the propagation
32+
style has been explicitly narrowed.
33+
cvss_v3: 7.5
34+
patched_versions:
35+
- ">= 2.32.0"
36+
related:
37+
url:
38+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
39+
- https://nvd.nist.gov/vuln/detail/CVE-2026-50276
40+
- https://rubygems.org/gems/datadog/versions/2.32.0
41+
- https://github.com/DataDog/dd-trace-rb/blob/master/CHANGELOG.md#2320---2026-05-08
42+
- https://advisories.gitlab.com/gem/datadog/CVE-2026-50276
43+
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
44+
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j
45+
- https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98
46+
- https://github.com/advisories/GHSA-p5f6-rccc-jv98
47+
notes: |
48+
- cvss_v3 value comes from GHSA.
49+
- No CVE.
50+
---

‎advisories/_posts/2026-07-15-GHSA-5qhf-9phg-95m2.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-5qhf-9phg-95m2 (loofah): Loofah `allowed_uri?` does not detect `javascript:`
4+
URIs split by numeric character references without semicolons'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
ghsa: 5qhf-9phg-95m2
11+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
12+
title: Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric
13+
character references without semicolons
14+
date: 2026-07-15
15+
description: |-
16+
## Summary
17+
18+
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
19+
or vbscript: URIs when the scheme is split by a numeric character
20+
reference that has no trailing semicolon. A browser decodes such
21+
references and resolves the URL to an executable javascript: scheme,
22+
while allowed_uri? reports it safe.
23+
24+
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
25+
numeric character references with a trailing ; (&#9;, &#10;, &#13;)
26+
but did not cover the forms without semicolons.
27+
28+
## Impact
29+
30+
Callers that validate a user-controlled URL with
31+
Loofah::HTML5::Scrub.allowed_uri? and then render the approved value
32+
into an href or other browser-interpreted URI attribute may be
33+
vulnerable to cross-site scripting (XSS). This includes applications
34+
that call allowed_uri? directly, as well as higher-level features
35+
built on top of it, such as Action Text 8.2's markdown link validation.
36+
37+
## Credit
38+
39+
Responsibly reported by GitHub user @MoonFuji.
40+
unaffected_versions:
41+
- "< 2.25.0"
42+
patched_versions:
43+
- ">= 2.25.2"
44+
related:
45+
url:
46+
- https://rubygems.org/gems/loofah/versions/2.25.2
47+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
48+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
49+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
50+
notes: |
51+
- "Low" severity from GHSA
52+
- No CVE.
53+
---

‎advisories/_posts/2026-07-15-GHSA-8whx-365g-h9vv.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-8whx-365g-h9vv (loofah): Loofah `allowed_uri?` does not detect `javascript:`
4+
URIs split by named whitespace character references'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
ghsa: 8whx-365g-h9vv
11+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
12+
title: Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace
13+
character references
14+
date: 2026-07-15
15+
description: |-
16+
## Summary
17+
18+
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
19+
URIs when the scheme is split or prefixed by the HTML5 named character
20+
references &Tab; (tab) or &NewLine; (line feed).
21+
22+
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
23+
the equivalent numeric character references (&#9;, &#10;, &#13;) but
24+
did not cover the named forms.
25+
unaffected_versions:
26+
- "< 2.25.0"
27+
patched_versions:
28+
- ">= 2.25.2"
29+
related:
30+
url:
31+
- https://rubygems.org/gems/loofah/versions/2.25.2
32+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
33+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
34+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
35+
notes: |
36+
- "Low" severity from GHSA
37+
- No CVE.
38+
---

‎advisories/_posts/2026-07-15-GHSA-9wjq-cp2p-hrgf.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-9wjq-cp2p-hrgf (loofah): SVG `href` attribute bypasses local-reference
4+
restriction in Loofah'
5+
comments: false
6+
categories:
7+
- loofah
8+
advisory:
9+
gem: loofah
10+
ghsa: 9wjq-cp2p-hrgf
11+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
12+
title: SVG `href` attribute bypasses local-reference restriction in Loofah
13+
date: 2026-07-15
14+
description: |-
15+
## Summary
16+
17+
Loofah's HTML5 sanitizer restricted only the xlink:href attribute on
18+
certain SVG elements to local, same-document references. Browsers
19+
also accept a plain href attribute as an alternative to the deprecated
20+
xlink:href per the SVG 2 spec, but Loofah did not apply the same
21+
restriction to it, allowing those elements to reference arbitrary
22+
external documents.
23+
24+
## Impact
25+
26+
SVG <use> can load and render external SVG content by reference. If
27+
the referenced external SVG is same-origin and contains scripts or
28+
other dangerous content, it could execute in the context of the
29+
sanitized document. <feImage> can load external images, which can be
30+
used for tracking. Modern browsers restrict cross-origin <use>
31+
fetches, which limits but does not eliminate the risk.
32+
33+
Applications that sanitize user-supplied SVG (directly, or as part
34+
of HTML) with Loofah's default allowlist are affected.
35+
36+
## Credit
37+
38+
Found by the maintainer, Mike Dalessio, during a security audit.
39+
cvss_v3: 4.7
40+
patched_versions:
41+
- ">= 2.25.2"
42+
related:
43+
url:
44+
- https://rubygems.org/gems/loofah/versions/2.25.2
45+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
46+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
47+
notes: |
48+
- cvss_v3 value from GHSA
49+
- No CVE.
50+
---

‎advisories/_posts/2026-07-15-GHSA-cj75-f6xr-r4g7.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with
4+
certain configurations of rails-html-sanitizer'
5+
comments: false
6+
categories:
7+
- rails-html-sanitizer
8+
- rails
9+
advisory:
10+
gem: rails-html-sanitizer
11+
framework: rails
12+
ghsa: cj75-f6xr-r4g7
13+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
14+
title: Possible XSS vulnerability with certain configurations of rails-html-sanitizer
15+
date: 2026-07-15
16+
description: |-
17+
## Summary
18+
19+
There is a possible cross-site scripting vulnerability in
20+
rails-html-sanitizer when the sanitizer is configured to allow an
21+
SVG reference element such as <use>.
22+
See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference
23+
logic rails-html-sanitizer mirrors.
24+
unaffected_versions:
25+
- "< 1.0.3"
26+
patched_versions:
27+
- ">= 1.7.1"
28+
related:
29+
url:
30+
- https://rubygems.org/gems/rails-html-sanitizer/versions/1.7.1
31+
- https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md#v171--2026-07-15
32+
- https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586
33+
- https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359#post_1
34+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
35+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
36+
notes: |
37+
- "Moderate" severity in GHSA
38+
- No CVE.
39+
---

0 commit comments

Comments
 (0)