# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first

- [Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps](https://agentprime.io/advisories/GHSA-6j52-38f8-qhxr.md)
  `GHSA-6j52-38f8-qhxr`, `CVE-2026-63414` · RubyGems `shopify_app`: affected `>=22.1.0, <23.0.3`, fixed in `23.0.3` · CVSS 7.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Crass: Non-ASCII characters cause superlinear CPU consumption](https://agentprime.io/advisories/GHSA-8vfg-2r28-hvhj.md)
  `GHSA-8vfg-2r28-hvhj`, `CVE-2026-61848` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [Crass: A large number of adjacent CSS comments can trigger a SystemStackError](https://agentprime.io/advisories/GHSA-wwpr-jff3-395c.md)
  `GHSA-wwpr-jff3-395c`, `CVE-2026-61847` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage](https://agentprime.io/advisories/GHSA-6jxj-px6v-747w.md)
  `GHSA-6jxj-px6v-747w`, `CVE-2026-61846` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Denial of service
- [Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass](https://agentprime.io/advisories/GHSA-pq4g-8rxf-4g29.md)
  `GHSA-pq4g-8rxf-4g29`, `CVE-2026-116695` · RubyGems `crass`: affected `<1.0.8`, fixed in `1.0.8` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: CWE-436
- [Crass : Large numeric exponents cause CPU and memory denial of service](https://agentprime.io/advisories/GHSA-6wmf-3r64-vcwv.md)
  `GHSA-6wmf-3r64-vcwv`, `CVE-2026-61845` · RubyGems `crass`: affected `<1.0.7`, fixed in `1.0.7` · CVSS 8.9 High · Not analysed yet · Published 20 Oct 2026 · Tags: Denial of service
- [Mechanize sends credential headers to another origin after a meta refresh](https://agentprime.io/advisories/GHSA-c6rp-p8xm-4q9f.md)
  `GHSA-c6rp-p8xm-4q9f`, `CVE-2026-107399` · RubyGems `mechanize`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [Mechanize sends credential headers to another host after an HTTP redirect](https://agentprime.io/advisories/GHSA-2mwr-xjcg-37j7.md)
  `GHSA-2mwr-xjcg-37j7`, `CVE-2026-107715` · RubyGems `mechanize`: affected `<2.14.1`, fixed in `2.14.1` · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Hard-coded credentials
- [sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array](https://agentprime.io/advisories/GHSA-mwm8-39rw-8826.md)
  `GHSA-mwm8-39rw-8826` · RubyGems `sqlite3`: affected `>=1.4.0, <2.9.6`, fixed in `2.9.6` · CVSS 4.0, no score published · Not analysed yet · Published 2 Oct 2026 · Tags: Memory corruption
- [OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)](https://agentprime.io/advisories/GHSA-jjq7-m736-w977.md)
  `GHSA-jjq7-m736-w977`, `CVE-2026-77602` · RubyGems `openc3`: affected `>=5.1.0, <7.3.0`, fixed in `7.3.0` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: Code injection
- [OpenC3 COSMOS: Authenticated OS command injection via the \`pypi_url\` setting](https://agentprime.io/advisories/GHSA-vp3w-52v9-q57f.md)
  `GHSA-vp3w-52v9-q57f`, `CVE-2026-77601` · RubyGems `openc3`: affected `>=5.12.0, <7.3.0`, fixed in `7.3.0` · CVSS 8.8 High · Not analysed yet · Published 23 Sept 2026 · Tags: Command injection
- [Spree: Broken Access Control in \`PATCH /api/v3/store/carts/:id/associate\` (IDOR)](https://agentprime.io/advisories/GHSA-4825-p4xm-pcf2.md)
  `GHSA-4825-p4xm-pcf2`, `CVE-2026-94462` · RubyGems `spree_api`: affected `>=5.4.0, <5.4.4 || >=5.5.0, <5.5.4`, fixed in `5.4.4`, `5.5.4` · CVSS 7.1 High · Not analysed yet · Published 22 Sept 2026 · Tags: Broken access control
- [MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers](https://agentprime.io/advisories/GHSA-7952-gx68-cjqr.md)
  `GHSA-7952-gx68-cjqr`, `CVE-2026-65829`, `PYSEC-2026-4108` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=7.3.0, <16.5.0`, fixed in `16.5.0` · CVSS 5.3 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: Path traversal
- [MPXJ: XXE Vulnerability in MerlinReader](https://agentprime.io/advisories/GHSA-5vvx-3h34-f3gj.md)
  `GHSA-5vvx-3h34-f3gj`, `CVE-2026-61570`, `PYSEC-2026-4107` · Maven `net.sf.mpxj:mpxj` and 6 more: affected `>=5.5.5, <16.4.1`, fixed in `16.4.1` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2026 · Tags: XML external entities (XXE)
- [decidim-elections: Election question titles allow stored script execution](https://agentprime.io/advisories/GHSA-9mvp-w4rr-5c6x.md)
  `GHSA-9mvp-w4rr-5c6x`, `CVE-2026-44282` · RubyGems `decidim-elections`: affected `<0.32.0`, fixed in `0.32.0` · CVSS 4.8 Medium · Not analysed yet · Published 9 Sept 2026 · Tags: Cross-site scripting (XSS)
- [rubyzip path traversal vulnerability](https://agentprime.io/advisories/GHSA-47m2-wp7j-p9vc.md)
  `GHSA-47m2-wp7j-p9vc`, `CVE-2026-85396` · RubyGems `rubyzip`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 8.7 High · Not analysed yet · Published 3 Sept 2026 · Tags: Path traversal
- [Mail: Email address spoofing via malformed RFC 2047 encoded-words](https://agentprime.io/advisories/GHSA-mvxr-6m87-mv2q.md)
  `GHSA-mvxr-6m87-mv2q`, `CVE-2026-63435` · RubyGems `mail`: affected `<2.9.1`, fixed in `2.9.1` · CVSS 5.3 Medium · Not analysed yet · Published 2 Sept 2026 · Tags: CWE-436
- [Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute](https://agentprime.io/advisories/GHSA-xqqh-3w52-q8p7.md)
  `GHSA-xqqh-3w52-q8p7` · RubyGems `nokogiri`: affected `>=1.5.1`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-252
- [Duplicate Advisory: Nokogiri XSLT transform has a memory leak](https://agentprime.io/advisories/GHSA-rh9x-7xjc-vwx2.md)
  `GHSA-rh9x-7xjc-vwx2` · RubyGems `nokogiri`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service
- [Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking](https://agentprime.io/advisories/GHSA-5jhf-fpp7-v2pv.md)
  `GHSA-5jhf-fpp7-v2pv` · RubyGems `nokogiri`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 25 Aug 2026 · Tags: Denial of service
- [kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)](https://agentprime.io/advisories/GHSA-7pwq-q9jf-539h.md)
  `GHSA-7pwq-q9jf-539h`, `CVE-2026-55107` · RubyGems `kobako`: affected `>=0.1.0, <0.9.1`, fixed in `0.9.1` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Aug 2026 · Tags: Code injection
- [Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams](https://agentprime.io/advisories/GHSA-9hj4-r449-hfvc.md)
  `GHSA-9hj4-r449-hfvc`, `CVE-2026-71847` · RubyGems `json`: affected `>=2.20.0, <2.21.2`, fixed in `2.21.2` · CVSS 8.7 High · Not analysed yet · Published 7 Aug 2026 · Tags: Memory corruption
- [guard-livereload has a directory traversal vulnerability](https://agentprime.io/advisories/GHSA-g65v-27r3-5p6m.md)
  `GHSA-g65v-27r3-5p6m`, `CVE-2016-1000305` · RubyGems `guard-livereload`: affected `<2.5.2`, fixed in `2.5.2` · CVSS 4.0, no score published · Not analysed yet · Published 31 Jul 2026 · Tags: Path traversal
- [Savon::Model evaluates WSDL operation names as Ruby source](https://agentprime.io/advisories/GHSA-mx5j-mp4f-g8jg.md)
  `GHSA-mx5j-mp4f-g8jg`, `CVE-2026-53510` · RubyGems `savon`: affected `>=0.9.8, <2.17.2`, fixed in `2.17.2` · CVSS 8.1 High · Not analysed yet · Published 31 Jul 2026 · Tags: Code injection
- [Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing](https://agentprime.io/advisories/GHSA-xr9x-r78c-5hrm.md)
  `GHSA-xr9x-r78c-5hrm`, `CVE-2026-66066` · RubyGems `activestorage`: affected `<7.2.3.2 || >=8.0.0.beta1, <8.0.5.1 || >=8.1.0.beta1, <8.1.3.1`, fixed in `7.2.3.2`, `8.0.5.1`, `8.1.3.1` · CVSS 9.5 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.30 · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-1188
- [MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure](https://agentprime.io/advisories/GHSA-4mrv-5p47-p938.md)
  `GHSA-4mrv-5p47-p938`, `CVE-2026-54522` · RubyGems `msgpack`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 2.1 Low · Not analysed yet · Published 30 Jul 2026 · Tags: Memory corruption
- [MCP Ruby SDK: Ruby SSE Session Poisoning](https://agentprime.io/advisories/GHSA-5p9g-j988-pcwv.md)
  `GHSA-5p9g-j988-pcwv`, `CVE-2026-67431` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 8.3 High · Not analysed yet · Published 30 Jul 2026 · Tags: Broken access control
- [MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport](https://agentprime.io/advisories/GHSA-h669-8m4g-r2hc.md)
  `GHSA-h669-8m4g-r2hc`, `CVE-2026-67432` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 7.5 High · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service
- [MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood](https://agentprime.io/advisories/GHSA-52jp-gj8w-j6xh.md)
  `GHSA-52jp-gj8w-j6xh`, `CVE-2026-67430` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service
- [MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)](https://agentprime.io/advisories/GHSA-7683-3w9x-ch42.md)
  `GHSA-7683-3w9x-ch42`, `CVE-2026-63119` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 6.2 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: Denial of service
- [MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection](https://agentprime.io/advisories/GHSA-rjr6-rcgv-9m7m.md)
  `GHSA-rjr6-rcgv-9m7m`, `CVE-2026-63118` · RubyGems `mcp`: affected `<0.23.0`, fixed in `0.23.0` · CVSS 6.9 Medium · Not analysed yet · Published 30 Jul 2026 · Tags: CWE-346, CWE-350
- [ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal](https://agentprime.io/advisories/GHSA-pmwx-rm49-xv39.md)
  `GHSA-pmwx-rm49-xv39` · RubyGems `activerecord-tenanted`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 4.0, no score published · Not analysed yet · Published 29 Jul 2026 · Tags: Path traversal
- [Pagy I18n locale option is not validated before being used in a file path](https://agentprime.io/advisories/GHSA-2xmw-f8j8-wfxc.md)
  `GHSA-2xmw-f8j8-wfxc`, `CVE-2026-54659` · RubyGems `pagy`: affected `>=43.0.0, <43.5.6`, fixed in `43.5.6` · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: Path traversal, Information disclosure
- [OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host](https://agentprime.io/advisories/GHSA-pp92-crg2-gfv9.md)
  `GHSA-pp92-crg2-gfv9`, `CVE-2026-54603` · RubyGems `oauth2`: affected `>=0.4.0, <2.0.22`, fixed in `2.0.22` · CVSS 8.6 High · Not analysed yet · Published 28 Jul 2026 · Tags: Information disclosure, Open redirect
- [OAuth: Cross-origin token-request redirects can expose signed request metadata](https://agentprime.io/advisories/GHSA-prq8-7wvh-44qh.md)
  `GHSA-prq8-7wvh-44qh`, `CVE-2026-54605` · RubyGems `oauth`: affected `>=0.5.5, <1.1.6`, fixed in `1.1.6` · CVSS 7.2 High · Not analysed yet · Published 28 Jul 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-346
- [sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks](https://agentprime.io/advisories/GHSA-j7fr-3v8c-3qc3.md)
  `GHSA-j7fr-3v8c-3qc3`, `CVE-2026-54620` · RubyGems `sqlite3` and 1 more: affected `>=2.1.0, <2.9.5`, fixed in `2.9.5` · CVSS 2.0 Low · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption
- [sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity](https://agentprime.io/advisories/GHSA-28hh-pr2h-2w89.md)
  `GHSA-28hh-pr2h-2w89`, `CVE-2026-54619` · RubyGems `sqlite3` and 1 more: affected `<2.9.5`, fixed in `2.9.5` · CVSS 2.0 Low · Not analysed yet · Published 28 Jul 2026 · Tags: Memory corruption
- [Trix: Stored XSS via HTMLParser attribute injection on paste](https://agentprime.io/advisories/GHSA-53g2-mvcc-q9x3.md)
  `GHSA-53g2-mvcc-q9x3`, `CVE-2026-73428` · npm `trix` and 1 more: affected `<2.1.18`, fixed in `2.1.18` · CVSS 4.6 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Ruby json: JSON generator heap buffer overflow when streaming to an IO](https://agentprime.io/advisories/GHSA-x2f5-4prf-w687.md)
  `GHSA-x2f5-4prf-w687`, `CVE-2026-54696` · RubyGems `json`: affected `>=2.9.0, <2.19.9`, fixed in `2.19.9` · CVSS 3.7 Low · Not analysed yet · Published 23 Jul 2026 · Tags: Memory corruption
- [Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations](https://agentprime.io/advisories/GHSA-cj75-f6xr-r4g7.md)
  `GHSA-cj75-f6xr-r4g7`, `CVE-2026-73648` · RubyGems `rails-html-sanitizer`: affected `>=1.0.3, <1.7.1`, fixed in `1.7.1` · CVSS 5.1 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS)
- [Loofah \`allowed_uri?\` does not detect \`javascript:\` URIs split by numeric character references without semicolons](https://agentprime.io/advisories/GHSA-5qhf-9phg-95m2.md)
  `GHSA-5qhf-9phg-95m2`, `CVE-2026-73492` · RubyGems `loofah`: affected `>=2.25.0, <2.25.2`, fixed in `2.25.2` · CVSS 2.3 Low · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-184
- [Loofah: SVG \`href\` attribute bypasses local-reference restriction](https://agentprime.io/advisories/GHSA-9wjq-cp2p-hrgf.md)
  `GHSA-9wjq-cp2p-hrgf`, `CVE-2026-73490` · RubyGems `loofah`: affected `<2.25.2`, fixed in `2.25.2` · CVSS 4.7 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: Cross-site scripting (XSS)
- [websocket-driver-ruby: Denial of service via malformed Host header](https://agentprime.io/advisories/GHSA-2x63-gw47-w4mm.md)
  `GHSA-2x63-gw47-w4mm`, `CVE-2026-61666` · RubyGems `websocket-driver`: affected `<0.8.2`, fixed in `0.8.2` · CVSS 8.9 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-248
- [Loofah \`allowed_uri?\` does not detect \`javascript:\` URIs split by named whitespace character references](https://agentprime.io/advisories/GHSA-8whx-365g-h9vv.md)
  `GHSA-8whx-365g-h9vv`, `CVE-2026-73491` · RubyGems `loofah`: affected `>=2.25.0, <2.25.2`, fixed in `2.25.2` · CVSS 2.3 Low · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-184
- [dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-p5f6-rccc-jv98.md)
  `GHSA-p5f6-rccc-jv98`, `CVE-2026-50276` · RubyGems `datadog`: affected `<2.32.0`, fixed in `2.32.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [ViewComponent: Reused Component Instances Retain Stale Render Context](https://agentprime.io/advisories/GHSA-9h85-g7w3-rh49.md)
  `GHSA-9h85-g7w3-rh49`, `CVE-2026-54497` · RubyGems `view_component`: affected `>=4.0.0, <4.12.0`, fixed in `4.12.0` · CVSS 6.8 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Race condition, Information disclosure, CWE-488
- [ViewComponent: around_render HTML-Safety Bypass](https://agentprime.io/advisories/GHSA-97jw-64cj-jc58.md)
  `GHSA-97jw-64cj-jc58`, `CVE-2026-54498` · RubyGems `view_component`: affected `>=4.0.0, <4.12.0`, fixed in `4.12.0` · CVSS 8.7 High · Not analysed yet · Published 15 Jul 2026 · Tags: Cross-site scripting (XSS)
- [websocket-driver: Memory exhaustion in HTTP header parser](https://agentprime.io/advisories/GHSA-8j3g-f24p-4mpw.md)
  `GHSA-8j3g-f24p-4mpw`, `CVE-2026-54465` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [websocket-driver: Resource limit bypass via message compression](https://agentprime.io/advisories/GHSA-33ph-fccm-39pj.md)
  `GHSA-33ph-fccm-39pj`, `CVE-2026-54464` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.3 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [websocket-driver: Memory exhaustion via abuse of protocol length headers](https://agentprime.io/advisories/GHSA-ghhp-3qvg-889p.md)
  `GHSA-ghhp-3qvg-889p`, `CVE-2026-54463` · RubyGems `websocket-driver`: affected `<0.8.1`, fixed in `0.8.1` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service
- [Decidim: Push subscriptions can be abused for server-side requests](https://agentprime.io/advisories/GHSA-2g9c-vf8h-prxx.md)
  `GHSA-2g9c-vf8h-prxx`, `CVE-2026-45573` · RubyGems `decidim-core`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 6.4 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Server-side request forgery (SSRF)
- [Decidim: HTML content blocks allow stored script execution](https://agentprime.io/advisories/GHSA-533c-2vh9-4r86.md)
  `GHSA-533c-2vh9-4r86`, `CVE-2026-45572` · RubyGems `decidim-core`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 4.8 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Code injection
- [Decidim: CSV census record endpoints improper authorization](https://agentprime.io/advisories/GHSA-q79h-67vx-m9xg.md)
  `GHSA-q79h-67vx-m9xg`, `CVE-2026-45415` · RubyGems `decidim-verifications`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 6.0 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control
- [Decidim: JWT-backed authentication can be replayed across organizations](https://agentprime.io/advisories/GHSA-r3v7-5x4c-c69q.md)
  `GHSA-r3v7-5x4c-c69q`, `CVE-2026-45414` · RubyGems `decidim`: affected `<0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.31.5`, `0.32.0` · CVSS 8.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Authentication bypass, Broken access control
- [Decidim: Verification documents can be downloaded through reusable links](https://agentprime.io/advisories/GHSA-3mvf-82qp-8qh5.md)
  `GHSA-3mvf-82qp-8qh5`, `CVE-2026-45378` · RubyGems `decidim-verifications`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Information disclosure
- [Decidim: Private exports can be downloaded through reusable links](https://agentprime.io/advisories/GHSA-767h-63j4-5226.md)
  `GHSA-767h-63j4-5226`, `CVE-2026-45377` · RubyGems `decidim-core`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 6.5 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Information disclosure, Broken access control
- [Decidim: Admin user search allows SQL injection through similarity-based sorting](https://agentprime.io/advisories/GHSA-jvqq-cvh4-xm37.md)
  `GHSA-jvqq-cvh4-xm37`, `CVE-2026-45376` · RubyGems `decidim-admin`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 5.5 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: SQL injection
- [Decidim: Verification admins can access supplied IDs from other organizations](https://agentprime.io/advisories/GHSA-86fh-w43w-338c.md)
  `GHSA-86fh-w43w-338c`, `CVE-2026-45330` · RubyGems `decidim-verifications`: affected `<0.30.9 || >=0.31.0.rc1, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.30.9`, `0.31.5`, `0.32.0` · CVSS 4.9 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Information disclosure, Broken access control
- [Decidim: Forms admin question editor lacks authorization](https://agentprime.io/advisories/GHSA-vq6j-hj8w-7v39.md)
  `GHSA-vq6j-hj8w-7v39`, `CVE-2026-45086` · RubyGems `decidim-demographics`: affected `>=0.31.0, <0.31.5 || >=0.32.0.rc1, <0.32.0`, fixed in `0.31.5`, `0.32.0` · CVSS 5.4 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control
- [Excon does not redact additional sensitive/risky headers when following redirects](https://agentprime.io/advisories/GHSA-48rx-c7pg-q66r.md)
  `GHSA-48rx-c7pg-q66r`, `CVE-2026-54171` · RubyGems `excon`: affected `<1.5.0`, fixed in `1.5.0` · CVSS 6.5 Medium · Not analysed yet · Published 10 Jul 2026 · Tags: Information disclosure, Hard-coded credentials

Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDI2LTA3LTEwVDIwOjM3OjI5LjAwMDAwMFoiLCJHSFNBLTQ4cngtYzdwZy1xNjZyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/>. Everything for agents: <https://agentprime.io/llms.txt>.