# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Duplicate Advisory: govuk_tech_docs vulnerable to unescaped HTML on search results page](https://agentprime.io/advisories/GHSA-4mvm-xh8j-fv27.md)
  `GHSA-4mvm-xh8j-fv27` · RubyGems `govuk_tech_docs`: affected `>=2.0.2`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs](https://agentprime.io/advisories/GHSA-4553-hq82-8654.md)
  `GHSA-4553-hq82-8654` · RubyGems `encoded_id-rails`: affected `*`, no fixed version yet · CVSS 7.5 High · Withdrawn · Not analysed yet · Published 4 Jan 2024 · Tags: Denial of service
- [Omniauth::MicrosoftGraph Account takeover (nOAuth)](https://agentprime.io/advisories/GHSA-5g66-628f-7cvj.md)
  `GHSA-5g66-628f-7cvj`, `CVE-2024-21632` · RubyGems `omniauth-microsoft_graph`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 8.6 High · Not analysed yet · Published 3 Jan 2024 · Tags: Authentication bypass
- [ActiveAdmin CSV Injection leading to sensitive information disclosure](https://agentprime.io/advisories/GHSA-xhvv-3jww-c487.md)
  `GHSA-xhvv-3jww-c487`, `CVE-2023-51763` · RubyGems `activeadmin`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 5.2 Medium · Not analysed yet · Published 28 Dec 2023 · Tags: Other injection
- [Duplicate Advisory: ActiveAdmin vulnerable to CSV injection](https://agentprime.io/advisories/GHSA-rqxc-9p8h-xqgq.md)
  `GHSA-rqxc-9p8h-xqgq` · RubyGems `activeadmin`: affected `<3.2.0`, fixed in `3.2.0` · CVSS 8.4 High · Withdrawn · Not analysed yet · Published 24 Dec 2023 · Tags: Other injection
- [Resque vulnerable to Reflected Cross Site Scripting through pathnames](https://agentprime.io/advisories/GHSA-r8xx-8vm8-x6wj.md)
  `GHSA-r8xx-8vm8-x6wj`, `CVE-2023-50724` · RubyGems `resque`: affected `<2.1.0`, fixed in `2.1.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [Resque vulnerable to reflected XSS in resque-web failed and queues lists](https://agentprime.io/advisories/GHSA-gc3j-vvwf-4rp8.md)
  `GHSA-gc3j-vvwf-4rp8`, `CVE-2023-50725` · RubyGems `resque`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [Resque vulnerable to reflected XSS in Queue Endpoint](https://agentprime.io/advisories/GHSA-r9mq-m72x-257g.md)
  `GHSA-r9mq-m72x-257g`, `CVE-2023-50727` · RubyGems `resque`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS), CWE-233
- [Resque Scheduler Reflected XSS In Delayed Jobs View](https://agentprime.io/advisories/GHSA-9hmq-fm33-x4xx.md)
  `GHSA-9hmq-fm33-x4xx`, `CVE-2022-44303` · RubyGems `resque-scheduler`: affected `>=1.27.4, <4.10.2`, fixed in `4.10.2` · CVSS 6.3 Medium · Not analysed yet · Published 18 Dec 2023 · Tags: Cross-site scripting (XSS)
- [Potential CSV export data leak](https://agentprime.io/advisories/GHSA-356j-hg45-x525.md)
  `GHSA-356j-hg45-x525`, `CVE-2023-50448` · RubyGems `activeadmin`: affected `<2.12.0`, fixed in `2.12.0` · CVSS 8.4 High · Not analysed yet · Published 15 Dec 2023 · Tags: Information disclosure, Other injection
- [pubnub Insufficient Entropy vulnerability](https://agentprime.io/advisories/GHSA-5844-q3fc-56rh.md)
  `GHSA-5844-q3fc-56rh`, `CVE-2023-26154`, `GO-2023-2385`, `PKSA-fyvg-jy6y-h7w5`, `PYSEC-2026-1807` · crates.io `pubnub` and 11 more: affected `<0.4.0`, fixed in `0.4.0` · CVSS 5.9 Medium · Not analysed yet · Published 6 Dec 2023 · Tags: CWE-331
- [CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS](https://agentprime.io/advisories/GHSA-gxhx-g4fq-49hj.md)
  `GHSA-gxhx-g4fq-49hj`, `CVE-2023-49090` · RubyGems `carrierwave`: affected `<2.2.5 || >=3.0.0, <3.0.5`, fixed in `2.2.5`, `3.0.5` · CVSS 6.8 Medium · Not analysed yet · Published 29 Nov 2023 · Tags: Cross-site scripting (XSS)
- [memory leak flaw was found in ruby-magick](https://agentprime.io/advisories/GHSA-frgf-8jr5-j2jv.md)
  `GHSA-frgf-8jr5-j2jv`, `CVE-2023-5349` · RubyGems `rmagick`: affected `<5.3.0`, fixed in `5.3.0` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2023 · Tags: Denial of service
- [encoded_id-rails potential DOS vulnerability due to URIs with extremely long encoded IDs](https://agentprime.io/advisories/GHSA-3px7-jm2p-6h2c.md)
  `GHSA-3px7-jm2p-6h2c`, `CVE-2024-0241` · RubyGems `encoded_id-rails`: affected `<1.0.0.beta2`, fixed in `1.0.0.beta2` · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2023 · Tags: Denial of service
- [svg_optimizer rubygem external XML entity (XXE) vulnerability](https://agentprime.io/advisories/GHSA-6hvg-62q8-95v7.md)
  `GHSA-6hvg-62q8-95v7`, `CVE-2023-46035` · RubyGems `svg_optimizer`: affected `>=0.2.6, <0.3.0`, fixed in `0.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2023 · Tags: XML external entities (XXE), Denial of service
- [Puppet Bolt privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-289m-2964-f8q5.md)
  `GHSA-289m-2964-f8q5`, `CVE-2023-5214` · RubyGems `bolt`: affected `<3.27.4`, fixed in `3.27.4` · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2023 · Tags: Privilege escalation
- [geokit-rails Command Injection vulnerability](https://agentprime.io/advisories/GHSA-7xvc-v44j-46fh.md)
  `GHSA-7xvc-v44j-46fh`, `CVE-2023-26153` · RubyGems `geokit-rails`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2023 · Tags: Command injection, Insecure deserialization
- [Decidim has broken access control in templates](https://agentprime.io/advisories/GHSA-639h-86hw-qcjq.md)
  `GHSA-639h-86hw-qcjq`, `CVE-2023-36465` · RubyGems `decidim` and 1 more: affected `>=0.23.2, <0.26.8 || >=0.27.0, <0.27.4`, fixed in `0.26.8`, `0.27.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2023 · Tags: Broken access control
- [Foreman Transpilation Enables OS Command Injection](https://agentprime.io/advisories/GHSA-9jfq-54vc-9rr2.md)
  `GHSA-9jfq-54vc-9rr2`, `CVE-2022-3874` · RubyGems `foreman`: affected `<=3.8.0`, no fixed version yet · CVSS 8.0 High · Withdrawn · Not analysed yet · Published 22 Sept 2023 · Tags: Command injection
- [sidekiq Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-3qc2-v3hp-6cv8.md)
  `GHSA-3qc2-v3hp-6cv8`, `CVE-2023-26141` · RubyGems `sidekiq`: affected `<6.5.10 || >=7.0.0, <7.1.3`, fixed in `6.5.10`, `7.1.3` · CVSS 7.5 High · Not analysed yet · Published 14 Sept 2023 · Tags: Denial of service, CWE-345
- [Denial of Service Vulnerability in gRPC TCP Server (Posix-compatible platforms)](https://agentprime.io/advisories/GHSA-p25m-jpj4-qcrr.md)
  `GHSA-p25m-jpj4-qcrr`, `CVE-2023-4785`, `PYSEC-2026-1428` · PyPI `grpcio` and 1 more: affected `>=1.53.0, <1.53.2 || >=1.54.0, <1.54.3 || >=1.55.0, <1.55.3`, fixed in `1.53.2`, `1.54.3`, `1.55.3` · CVSS 7.5 High · Not analysed yet · Published 13 Sept 2023 · Tags: CWE-248
- [Active Support Possibly Discloses Locally Encrypted Files](https://agentprime.io/advisories/GHSA-cr5q-6q9f-rq6q.md)
  `GHSA-cr5q-6q9f-rq6q`, `CVE-2023-38037` · RubyGems `activesupport`: affected `>=5.2.0, <6.1.7.5 || >=7.0.0, <7.0.7.1`, fixed in `6.1.7.5`, `7.0.7.1` · CVSS 5.5 Medium · Not analysed yet · Published 23 Aug 2023 · Tags: Broken access control, CWE-377
- [Puma HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-68xg-gqqm-vgj8.md)
  `GHSA-68xg-gqqm-vgj8`, `CVE-2023-40175` · RubyGems `puma`: affected `<5.6.7 || >=6.0.0, <6.3.1`, fixed in `5.6.7`, `6.3.1` · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2023 · Tags: HTTP request smuggling
- [Excessive Iteration in gRPC](https://agentprime.io/advisories/GHSA-496j-2rq6-j6cc.md)
  `GHSA-496j-2rq6-j6cc`, `CVE-2023-33953`, `PYSEC-2026-1424` · PyPI `grpcio` and 1 more: affected `<1.53.2 || >=1.54.0, <1.54.3 || >=1.55.0, <1.55.2 || >=1.56.0, <1.56.2`, fixed in `1.53.2`, `1.54.3`, `1.55.2`, `1.56.2` · CVSS 7.5 High · Not analysed yet · Published 9 Aug 2023 · Tags: Denial of service
- [Several quadratic complexity bugs may lead to denial of service in Commonmarker](https://agentprime.io/advisories/GHSA-7vh7-fw88-wj87.md)
  `GHSA-7vh7-fw88-wj87` · RubyGems `commonmarker`: affected `<0.23.10`, fixed in `0.23.10` · No CVSS score · Not analysed yet · Published 8 Aug 2023 · Tags: Denial of service
- [protocol-http1 HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-6jwc-qr2q-7xwj.md)
  `GHSA-6jwc-qr2q-7xwj`, `CVE-2023-38697` · RubyGems `protocol-http1`: affected `<0.15.1`, fixed in `0.15.1` · CVSS 5.8 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: HTTP request smuggling
- [rswag vulnerable to arbitrary JSON and YAML file read via directory traversal](https://agentprime.io/advisories/GHSA-vc79-65pr-q82v.md)
  `GHSA-vc79-65pr-q82v`, `CVE-2023-38337` · RubyGems `rswag`: affected `<2.10.1`, fixed in `2.10.1` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2023 · Tags: Path traversal
- [Decidim Cross-site Scripting vulnerability in the external link redirections](https://agentprime.io/advisories/GHSA-469h-mqg8-535r.md)
  `GHSA-469h-mqg8-535r`, `CVE-2023-32693` · RubyGems `decidim` and 1 more: affected `>=0.25.0, <0.26.7 || >=0.27.0, <0.27.3`, fixed in `0.26.7`, `0.27.3` · CVSS 8.1 High · Not analysed yet · Published 11 Jul 2023 · Tags: Cross-site scripting (XSS)
- [Decidim Cross-site Scripting vulnerability in the processes filter](https://agentprime.io/advisories/GHSA-5652-92r9-3fx9.md)
  `GHSA-5652-92r9-3fx9`, `CVE-2023-34089` · RubyGems `decidim` and 1 more: affected `>=0.14.0, <0.26.7 || >=0.27.0, <0.27.3`, fixed in `0.26.7`, `0.27.3` · CVSS 8.1 High · Not analysed yet · Published 11 Jul 2023 · Tags: Cross-site scripting (XSS)
- [Decidim vulnerable to sensitive data disclosure](https://agentprime.io/advisories/GHSA-jm79-9pm4-vrw9.md)
  `GHSA-jm79-9pm4-vrw9`, `CVE-2023-34090` · RubyGems `decidim` and 1 more: affected `>=0.27.0, <0.27.3`, fixed in `0.27.3` · CVSS 7.5 High · Not analysed yet · Published 11 Jul 2023 · Tags: Information disclosure
- [gRPC connection termination issue](https://agentprime.io/advisories/GHSA-9hxf-ppjv-w6rq.md)
  `GHSA-9hxf-ppjv-w6rq`, `CVE-2023-32732`, `PYSEC-2026-1426` · Maven `io.grpc:grpc-protobuf` and 2 more: affected `>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2`, fixed in `1.53.1`, `1.54.2` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2023 · Tags: CWE-440
- [gRPC Reachable Assertion issue](https://agentprime.io/advisories/GHSA-6628-q6j9-w8vg.md)
  `GHSA-6628-q6j9-w8vg`, `CVE-2023-1428`, `PYSEC-2026-1425` · Maven `io.grpc:grpc-protobuf` and 2 more: affected `>=1.51.0, <1.53.0`, fixed in `1.53.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2023 · Tags: Denial of service
- [Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of \`style\` element content](https://agentprime.io/advisories/GHSA-f5ww-cq3m-q3g7.md)
  `GHSA-f5ww-cq3m-q3g7`, `CVE-2023-36823` · RubyGems `sanitize`: affected `>=3.0.0, <6.0.2`, fixed in `6.0.2` · CVSS 7.1 High · Not analysed yet · Published 6 Jul 2023 · Tags: Cross-site scripting (XSS)
- [Connection confusion in gRPC](https://agentprime.io/advisories/GHSA-cfgp-2977-2fmm.md)
  `GHSA-cfgp-2977-2fmm`, `CVE-2023-32731`, `PYSEC-2026-1427` · Maven `io.grpc:grpc-protobuf` and 2 more: affected `>=1.53.0, <1.53.1 || >=1.54.0, <1.54.2`, fixed in `1.53.1`, `1.54.2` · CVSS 7.4 High · Not analysed yet · Published 5 Jul 2023 · Tags: CWE-440
- [URI gem has ReDoS vulnerability](https://agentprime.io/advisories/GHSA-hww2-5g85-429m.md)
  `GHSA-hww2-5g85-429m`, `CVE-2023-36617` · RubyGems `uri`: affected `<0.10.0.3 || >=0.10.1, <0.10.3 || >=0.11.0, <0.11.2 || >=0.12.0, <0.12.2`, fixed in `0.10.0.3`, `0.10.3`, `0.11.2`, `0.12.2` · CVSS 5.3 Medium · Not analysed yet · Published 29 Jun 2023 · Tags: Denial of service
- [Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to](https://agentprime.io/advisories/GHSA-4g8v-vg43-wpgf.md)
  `GHSA-4g8v-vg43-wpgf`, `CVE-2023-28362` · RubyGems `actionpack`: affected `<6.1.7.4 || >=7.0.0, <7.0.5.1`, fixed in `6.1.7.4`, `7.0.5.1` · CVSS 4.0 Medium · Not analysed yet · Published 29 Jun 2023 · Tags: CWE-116
- [Spina Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-97wh-6hmj-g8j9.md)
  `GHSA-97wh-6hmj-g8j9`, `CVE-2023-3445` · RubyGems `spina`: affected `<2.15.1`, fixed in `2.15.1` · CVSS 3.5 Low · Not analysed yet · Published 28 Jun 2023 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: jQuery Cross Site Scripting vulnerability](https://agentprime.io/advisories/GHSA-257q-pv89-v3xv.md)
  `GHSA-257q-pv89-v3xv`, `CVE-2020-23064` · Maven `org.webjars.npm:jquery` and 3 more: affected `>=1.0.3, <3.5.0`, fixed in `3.5.0` · CVSS 6.1 Medium · Withdrawn · Not analysed yet · Published 26 Jun 2023 · Tags: Cross-site scripting (XSS)
- [Doorkeeper Improper Authentication vulnerability](https://agentprime.io/advisories/GHSA-7w2c-w47h-789w.md)
  `GHSA-7w2c-w47h-789w`, `CVE-2023-34246` · RubyGems `doorkeeper`: affected `<5.6.6`, fixed in `5.6.6` · CVSS 4.2 Medium · Not analysed yet · Published 12 Jun 2023 · Tags: Authentication bypass
- [rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements](https://agentprime.io/advisories/GHSA-xp5h-f8jf-rc8q.md)
  `GHSA-xp5h-f8jf-rc8q`, `CVE-2023-23913` · RubyGems `actionview`: affected `>=5.1.0, <6.1.7.3 || >=7.0.0, <7.0.4.3`, fixed in `6.1.7.3`, `7.0.4.3` · CVSS 6.3 Medium · Not analysed yet · Published 9 Jun 2023 · Tags: Cross-site scripting (XSS)
- [Kredis JSON Possible Deserialization of Untrusted Data Vulnerability](https://agentprime.io/advisories/GHSA-h2wm-p2vg-6pw4.md)
  `GHSA-h2wm-p2vg-6pw4`, `CVE-2023-27531` · RubyGems `kredis`: affected `<1.3.0.1`, fixed in `1.3.0.1` · CVSS 5.3 Medium · Not analysed yet · Published 9 Jun 2023 · Tags: Insecure deserialization
- [RedCloth Regular Expression Denial of Service issue](https://agentprime.io/advisories/GHSA-qcm3-vfq5-wfr2.md)
  `GHSA-qcm3-vfq5-wfr2`, `CVE-2023-31606` · RubyGems `RedCloth`: affected `<4.3.3`, fixed in `4.3.3` · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2023 · Tags: Denial of service
- [avo possible unsafe reflection / partial DoS vulnerability](https://agentprime.io/advisories/GHSA-86h2-2g4g-29qx.md)
  `GHSA-86h2-2g4g-29qx`, `CVE-2023-34102` · RubyGems `avo`: affected `<2.33.3 || >=3.0.0.pre1, <=3.0.0.pre12`, fixed in `2.33.3` · CVSS 8.3 High · Not analysed yet · Published 6 Jun 2023 · Tags: Code injection, CWE-20
- [avo vulnerable to Stored XSS (Cross Site Scripting) in html content based fields](https://agentprime.io/advisories/GHSA-5cr9-5jx3-2g39.md)
  `GHSA-5cr9-5jx3-2g39`, `CVE-2023-34103` · RubyGems `avo`: affected `<2.33.3 || >=3.0.0.pre1, <=3.0.0.pre12`, fixed in `2.33.3` · CVSS 7.3 High · Not analysed yet · Published 6 Jun 2023 · Tags: Cross-site scripting (XSS)
- [ruby-saml vulnerable to XPath injection](https://agentprime.io/advisories/GHSA-r364-2pj4-pf7f.md)
  `GHSA-r364-2pj4-pf7f`, `CVE-2015-20108` · RubyGems `ruby-saml`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 May 2023 · Tags: Command injection
- [Server-Side Template Injection in Camaleon CMS](https://agentprime.io/advisories/GHSA-x487-866m-p8hr.md)
  `GHSA-x487-866m-p8hr`, `CVE-2023-30145` · RubyGems `camaleon_cms`: affected `<2.7.4`, fixed in `2.7.4` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.46 · Not analysed yet · Published 26 May 2023 · Tags: Code injection
- [Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem](https://agentprime.io/advisories/GHSA-5xq9-h3j2-jxvc.md)
  `GHSA-5xq9-h3j2-jxvc`, `CVE-2023-25309` · RubyGems `rollout-ui`: affected `<0.5.3`, fixed in `0.5.3` · CVSS 6.1 Medium · Not analysed yet · Published 11 May 2023 · Tags: Cross-site scripting (XSS)
- [Race Condition leading to logging errors](https://agentprime.io/advisories/GHSA-hjp3-5g2q-7jww.md)
  `GHSA-hjp3-5g2q-7jww`, `CVE-2024-22047` · RubyGems `audited`: affected `>=4.0.0, <5.3.3`, fixed in `5.3.3` · CVSS 3.1 Low · Not analysed yet · Published 1 May 2023 · Tags: Race condition
- [Buffer overflow in sponge queue functions](https://agentprime.io/advisories/GHSA-6w4m-2xhg-2658.md)
  `GHSA-6w4m-2xhg-2658`, `BIT-libphp-2022-37454`, `BIT-libpython-2022-37454`, `BIT-php-2022-37454`, `BIT-php-min-2022-37454`, `BIT-python-2022-37454`, `BIT-python-min-2022-37454`, `CVE-2022-37454`, `PSF-2022-11`, `PYSEC-2026-504` · PyPI `pysha3` and 1 more: affected `<=1.0.2`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Apr 2023 · Tags: Memory corruption
- [Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform](https://agentprime.io/advisories/GHSA-65g2-x53q-cmf6.md)
  `GHSA-65g2-x53q-cmf6`, `CVE-2023-30618` · RubyGems `kitchen-terraform`: affected `>=7.0.0, <7.0.1`, fixed in `7.0.1` · CVSS 3.2 Low · Not analysed yet · Published 24 Apr 2023 · Tags: Information disclosure
- [sidekiq vulnerable to cross-site scripting](https://agentprime.io/advisories/GHSA-h3r8-h5qw-4r35.md)
  `GHSA-h3r8-h5qw-4r35`, `CVE-2023-1892` · RubyGems `sidekiq`: affected `>=7.0.4, <7.0.8`, fixed in `7.0.8` · CVSS 8.3 High · Not analysed yet · Published 21 Apr 2023 · Tags: Cross-site scripting (XSS)
- [Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay](https://agentprime.io/advisories/GHSA-cqf3-vpx7-rxhw.md)
  `GHSA-cqf3-vpx7-rxhw`, `CVE-2023-30614` · RubyGems `pay`: affected `<6.3.2`, fixed in `6.3.2` · CVSS 7.1 High · Not analysed yet · Published 20 Apr 2023 · Tags: Cross-site scripting (XSS)
- [Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service](https://agentprime.io/advisories/GHSA-48wp-p9qv-4j64.md)
  `GHSA-48wp-p9qv-4j64` · RubyGems `commonmarker`: affected `<0.23.9`, fixed in `0.23.9` · No CVSS score · Not analysed yet · Published 11 Apr 2023
- [Nokogiri updates packaged libxml2 to v2.10.4 to resolve multiple CVEs](https://agentprime.io/advisories/GHSA-pxvg-2qj5-37jq.md)
  `GHSA-pxvg-2qj5-37jq`, `CVE-2023-54354` · RubyGems `nokogiri`: affected `<1.14.3`, fixed in `1.14.3` · No CVSS score · Not analysed yet · Published 11 Apr 2023
- [govuk_tech_docs vulnerable to unescaped HTML on search results page](https://agentprime.io/advisories/GHSA-x2xw-hw8g-6773.md)
  `GHSA-x2xw-hw8g-6773`, `CVE-2024-22048` · RubyGems `govuk_tech_docs`: affected `>=2.0.2, <3.3.1`, fixed in `3.3.1` · CVSS 6.1 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: Cross-site scripting (XSS)
- [Fluent Fluentd and Fluent-ui use default password](https://agentprime.io/advisories/GHSA-wrxf-x8rm-6ggg.md)
  `GHSA-wrxf-x8rm-6ggg`, `BIT-fluentd-2020-21514`, `CVE-2020-21514` · RubyGems `fluentd-ui`: affected `<=1.2.2`, no fixed version yet · CVSS 8.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: Broken access control
- [Ruby URI component ReDoS issue](https://agentprime.io/advisories/GHSA-hv5j-3h9f-99c2.md)
  `GHSA-hv5j-3h9f-99c2`, `CVE-2023-28755` · RubyGems `uri`: affected `<0.10.0.1 || >=0.10.1, <0.10.2 || >=0.11.0, <0.11.1 || >=0.12.0, <0.12.1`, fixed in `0.10.0.1`, `0.10.2`, `0.11.1`, `0.12.1` · CVSS 7.5 High · Not analysed yet · Published 31 Mar 2023 · Tags: Denial of service
- [Ruby Time component ReDoS issue](https://agentprime.io/advisories/GHSA-fg7x-g82r-94qc.md)
  `GHSA-fg7x-g82r-94qc`, `BIT-ruby-2023-28756`, `BIT-ruby-min-2023-28756`, `CVE-2023-28756` · RubyGems `time`: affected `<0.1.1 || >=0.2.0, <0.2.2`, fixed in `0.1.1`, `0.2.2` · CVSS 7.5 High · Not analysed yet · Published 31 Mar 2023 · Tags: Denial of service
- [unpoly-rails Denial of Service vulnerability](https://agentprime.io/advisories/GHSA-m875-3xf6-mf78.md)
  `GHSA-m875-3xf6-mf78`, `CVE-2023-28846` · RubyGems `unpoly-rails`: affected `<2.7.2.2`, fixed in `2.7.2.2` · CVSS 5.9 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: Denial of service
- [Reflective Cross-site Scripting Vulnerability in twitter-bootstrap-rails](https://agentprime.io/advisories/GHSA-vpqv-mqvc-pcx2.md)
  `GHSA-vpqv-mqvc-pcx2`, `CVE-2014-4920` · RubyGems `twitter-bootstrap-rails`: affected `<3.2.0`, fixed in `3.2.0` · No CVSS score · Not analysed yet · Published 16 Mar 2023 · Tags: Cross-site scripting (XSS)

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIzLTAzLTE2VDE4OjM1OjExLjAwMDAwMFoiLCJHSFNBLXZwcXYtbXF2Yy1wY3gyIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDI0LTAxLTA0VDIxOjMwOjI0LjAwMDAwMFoiLCJHSFNBLWMydjQtY2h4NS12ZmY2Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDI0LTAxLTA0VDIxOjMwOjI0LjAwMDAwMFoiLCJHSFNBLWMydjQtY2h4NS12ZmY2Il0>. Everything for agents: <https://agentprime.io/llms.txt>.