# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Rack has a Directory Traversal via Rack:Directory](https://agentprime.io/advisories/GHSA-mxw3-3hh2-x2mh.md)
  `GHSA-mxw3-3hh2-x2mh`, `CVE-2026-22860` · RubyGems `rack`: affected `<2.2.22 || >=3.0.0.beta1, <3.1.20 || >=3.2.0, <3.2.5`, fixed in `2.2.22`, `3.1.20`, `3.2.5` · CVSS 7.5 High · Not analysed yet · Published 17 Feb 2026 · Tags: Path traversal, CWE-548
- [Bitcoinrb Vulnerable to Command injection via RPC](https://agentprime.io/advisories/GHSA-q66h-m87m-j2q6.md)
  `GHSA-q66h-m87m-j2q6` · RubyGems `bitcoinrb`: affected `<1.12.0`, fixed in `1.12.0` · CVSS 4.0, no score published · Not analysed yet · Published 10 Feb 2026 · Tags: Command injection
- [Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url](https://agentprime.io/advisories/GHSA-33mh-2634-fwr2.md)
  `GHSA-33mh-2634-fwr2`, `CVE-2026-25765` · RubyGems `faraday`: affected `>=1.0.0, <1.10.5 || >=2.0.0, <2.14.1`, fixed in `1.10.5`, `2.14.1` · CVSS 5.8 Medium · Not analysed yet · Published 9 Feb 2026 · Tags: Server-side request forgery (SSRF)
- [Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values](https://agentprime.io/advisories/GHSA-w67g-2h6v-vjgq.md)
  `GHSA-w67g-2h6v-vjgq` · RubyGems `phlex`: affected `<1.11.1 || >=2.0.0.beta1, <2.0.2 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.2 || >=2.3.0, <2.3.2 || >=2.4.0.beta1, <2.4.1`, fixed in `1.11.1`, `2.0.2`, `2.1.3`, `2.2.2`, `2.3.2`, `2.4.1` · CVSS 7.1 High · Not analysed yet · Published 6 Feb 2026 · Tags: Cross-site scripting (XSS)
- [Unauthenticated Spree Commerce users can access all guest addresses](https://agentprime.io/advisories/GHSA-87fh-rc96-6fr6.md)
  `GHSA-87fh-rc96-6fr6`, `CVE-2026-25758` · RubyGems `spree_api`: affected `<4.10.3 || >=5.0.0, <5.0.8 || >=5.1.0, <5.1.10 || >=5.2.0, <5.2.7 || >=5.3.0, <5.3.2`, fixed in `4.10.3`, `5.0.8`, `5.1.10`, `5.2.7`, `5.3.2` · CVSS 7.7 High · Not analysed yet · Published 5 Feb 2026 · Tags: Broken access control
- [Unauthenticated Spree Commerce users can view completed guest orders by Order ID](https://agentprime.io/advisories/GHSA-p6pv-q7rc-g4h9.md)
  `GHSA-p6pv-q7rc-g4h9`, `CVE-2026-25757` · RubyGems `spree_storefront`: affected `<5.0.8 || >=5.1.0, <5.1.10 || >=5.2.0, <5.2.7 || >=5.3.0, <5.3.2`, fixed in `5.0.8`, `5.1.10`, `5.2.7`, `5.3.2` · CVSS 7.7 High · Not analysed yet · Published 5 Feb 2026 · Tags: Broken access control
- [Decidim's private data exports can lead to data leaks](https://agentprime.io/advisories/GHSA-3cx6-j9j4-54mp.md)
  `GHSA-3cx6-j9j4-54mp`, `CVE-2025-65017` · RubyGems `decidim` and 1 more: affected `>=0.30.0, <0.30.4`, fixed in `0.30.4` · CVSS 8.2 High · Not analysed yet · Published 3 Feb 2026 · Tags: Information disclosure, CWE-703
- [fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation](https://agentprime.io/advisories/GHSA-m3hq-3qj8-c5fm.md)
  `GHSA-m3hq-3qj8-c5fm`, `CVE-2026-1530` · RubyGems `fog-kubevirt`: affected `<1.5.1`, fixed in `1.5.1` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Weak cryptography or TLS
- [foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set](https://agentprime.io/advisories/GHSA-2qxw-7fmx-gqfm.md)
  `GHSA-2qxw-7fmx-gqfm`, `CVE-2026-1531` · RubyGems `foreman_kubevirt`: affected `<0.4.3`, fixed in `0.4.3` · CVSS 8.1 High · Not analysed yet · Published 2 Feb 2026 · Tags: Weak cryptography or TLS
- [Cassandra Web - Remote File Read](https://agentprime.io/advisories/GHSA-8mfv-xhp5-48q9.md)
  `GHSA-8mfv-xhp5-48q9`, `CVE-2020-36939` · RubyGems `cassandra-web`: affected `<=0.5.0`, no fixed version yet · CVSS 8.7 High · Not analysed yet · Published 27 Jan 2026 · Tags: Path traversal
- [AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper](https://agentprime.io/advisories/GHSA-2762-657x-v979.md)
  `GHSA-2762-657x-v979`, `CVE-2026-23885` · RubyGems `alchemy_cms`: affected `<7.4.12 || >=8.0.0.a, <8.0.3`, fixed in `7.4.12`, `8.0.3` · CVSS 6.4 Medium · Not analysed yet · Published 21 Jan 2026 · Tags: Code injection
- [Active Job - Object injection security vulnerability](https://agentprime.io/advisories/GHSA-mpwp-4h2m-765c.md)
  `GHSA-mpwp-4h2m-765c` · RubyGems `activejob`: affected `<4.2.0.beta2`, fixed in `4.2.0.beta2` · CVSS 4.0, no score published · Not analysed yet · Published 16 Jan 2026 · Tags: Other injection
- [ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection](https://agentprime.io/advisories/GHSA-5qw5-wf2q-f538.md)
  `GHSA-5qw5-wf2q-f538` · RubyGems `activerecord-jdbc-adapter`: affected `<1.2.8`, fixed in `1.2.8` · CVSS 4.0, no score published · Not analysed yet · Published 16 Jan 2026 · Tags: SQL injection
- [openc3-api Vulnerable to Unauthenticated Remote Code Execution](https://agentprime.io/advisories/GHSA-w757-4qv9-mghp.md)
  `GHSA-w757-4qv9-mghp`, `CVE-2025-68271` · RubyGems `openc3`: affected `>=5.0.6, <6.10.2`, fixed in `6.10.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Jan 2026 · Tags: Code injection
- [Spree API has Unauthenticated IDOR - Guest Address](https://agentprime.io/advisories/GHSA-3ghg-3787-w2xr.md)
  `GHSA-3ghg-3787-w2xr`, `CVE-2026-22589` · RubyGems `spree_core`: affected `>=4.0.0, <4.10.2 || >=5.0.0, <5.0.7 || >=5.1.0, <5.1.9 || >=5.2.0, <5.2.5`, fixed in `4.10.2`, `5.0.7`, `5.1.9`, `5.2.5` · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: Broken access control
- [Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification](https://agentprime.io/advisories/GHSA-g268-72p7-9j6j.md)
  `GHSA-g268-72p7-9j6j`, `CVE-2026-22588` · RubyGems `spree_api`: affected `>=3.7.0, <4.10.2 || >=5.0.0, <5.0.7 || >=5.1.0, <5.1.9 || >=5.2.0, <5.2.5`, fixed in `4.10.2`, `5.0.7`, `5.1.9`, `5.2.5` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: Broken access control
- [Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles](https://agentprime.io/advisories/GHSA-96qw-h329-v5rg.md)
  `GHSA-96qw-h329-v5rg` · npm `shakapacker` and 1 more: affected `<9.5.0`, fixed in `9.5.0` · CVSS 7.5 High · Not analysed yet · Published 8 Jan 2026 · Tags: Information disclosure
- [Trix has a stored XSS vulnerability through its attachment attribute](https://agentprime.io/advisories/GHSA-g9jg-w8vm-g96v.md)
  `GHSA-g9jg-w8vm-g96v` · npm `trix` and 1 more: affected `<2.1.16`, fixed in `2.1.16` · CVSS 4.6 Medium · Not analysed yet · Published 31 Dec 2025 · Tags: Cross-site scripting (XSS)
- [URI Credential Leakage Bypass over CVE-2025-27221](https://agentprime.io/advisories/GHSA-j4pr-3wm6-xx2r.md)
  `GHSA-j4pr-3wm6-xx2r`, `CVE-2025-61594` · RubyGems `uri`: affected `<0.12.5 || >=0.13.0, <0.13.3 || >=1.0.0, <1.0.4`, fixed in `0.12.5`, `0.13.3`, `1.0.4` · CVSS 2.1 Low · Not analysed yet · Published 30 Dec 2025 · Tags: Information disclosure, CWE-212
- [httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage](https://agentprime.io/advisories/GHSA-hm5p-x4rq-38w4.md)
  `GHSA-hm5p-x4rq-38w4`, `CVE-2025-68696` · RubyGems `httparty`: affected `<0.24.0`, fixed in `0.24.0` · CVSS 7.8 High · Not analysed yet · Published 23 Dec 2025 · Tags: Server-side request forgery (SSRF)
- [AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue](https://agentprime.io/advisories/GHSA-2xgq-q749-89fq.md)
  `GHSA-2xgq-q749-89fq`, `CVE-2025-14762` · RubyGems `aws-sdk-s3`: affected `<1.208.0`, fixed in `1.208.0` · CVSS 6.0 Medium · Not analysed yet · Published 18 Dec 2025 · Tags: Weak cryptography or TLS
- [ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay](https://agentprime.io/advisories/GHSA-6gvq-jcmp-8959.md)
  `GHSA-6gvq-jcmp-8959`, `CVE-2025-68113`, `GO-2025-4239`, `PKSA-5rb8-j658-qvzz`, `PYSEC-2026-1115` · Go `github.com/altcha-org/altcha-lib-go` and 6 more: affected `<1.0.0`, fixed in `1.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 16 Dec 2025 · Tags: Weak cryptography or TLS, CWE-115
- [Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation](https://agentprime.io/advisories/GHSA-x4h9-gwv3-r4m4.md)
  `GHSA-x4h9-gwv3-r4m4`, `CVE-2025-66568` · RubyGems `ruby-saml`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: Weak cryptography or TLS
- [Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)](https://agentprime.io/advisories/GHSA-9v8j-x534-2fx3.md)
  `GHSA-9v8j-x534-2fx3`, `CVE-2025-66567` · RubyGems `ruby-saml`: affected `<1.18.0`, fixed in `1.18.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Dec 2025 · Tags: Weak cryptography or TLS
- [Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values](https://agentprime.io/advisories/GHSA-4249-gjr8-jpq3.md)
  `GHSA-4249-gjr8-jpq3` · RubyGems `prosemirror_to_html`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 13 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values](https://agentprime.io/advisories/GHSA-vfpf-xmwh-8m65.md)
  `GHSA-vfpf-xmwh-8m65` · RubyGems `prosemirror_to_html`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 7.6 High · Withdrawn · Not analysed yet · Published 7 Nov 2025 · Tags: Cross-site scripting (XSS)
- [MQTT does not validate hostnames](https://agentprime.io/advisories/GHSA-9c5q-w6gr-fxcq.md)
  `GHSA-9c5q-w6gr-fxcq`, `CVE-2025-12790` · RubyGems `mqtt`: affected `<0.7.0`, fixed in `0.7.0` · CVSS 7.4 High · Not analysed yet · Published 6 Nov 2025 · Tags: CWE-29
- [Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values](https://agentprime.io/advisories/GHSA-52c5-vh7f-26fx.md)
  `GHSA-52c5-vh7f-26fx`, `CVE-2025-64501` · RubyGems `prosemirror_to_html`: affected `<0.2.1`, fixed in `0.2.1` · CVSS 7.6 High · Not analysed yet · Published 6 Nov 2025 · Tags: Cross-site scripting (XSS)
- [Sinatra is vulnerable to ReDoS through ETag header value generation](https://agentprime.io/advisories/GHSA-mr3q-g2mv-mr4q.md)
  `GHSA-mr3q-g2mv-mr4q`, `CVE-2025-61921` · RubyGems `sinatra`: affected `<4.2.0`, fixed in `4.2.0` · CVSS 2.7 Low · Not analysed yet · Published 10 Oct 2025 · Tags: Denial of service
- [Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing](https://agentprime.io/advisories/GHSA-6xw4-3v39-52mm.md)
  `GHSA-6xw4-3v39-52mm`, `CVE-2025-61919` · RubyGems `rack`: affected `<2.2.20 || >=3.0, <3.1.18 || >=3.2, <3.2.3`, fixed in `2.2.20`, `3.1.18`, `3.2.3` · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2025 · Tags: Denial of service
- [Rack has a Possible Information Disclosure Vulnerability](https://agentprime.io/advisories/GHSA-r657-rxjc-j557.md)
  `GHSA-r657-rxjc-j557`, `CVE-2025-61780` · RubyGems `rack`: affected `<2.2.20 || >=3.0, <3.1.18 || >=3.2, <3.2.3`, fixed in `2.2.20`, `3.1.18`, `3.2.3` · CVSS 5.8 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: Information disclosure, CWE-441, CWE-913
- [Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)](https://agentprime.io/advisories/GHSA-wpv5-97wm-hp9c.md)
  `GHSA-wpv5-97wm-hp9c`, `CVE-2025-61772` · RubyGems `rack`: affected `<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2`, fixed in `2.2.19`, `3.1.17`, `3.2.2` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2025 · Tags: Denial of service
- [Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)](https://agentprime.io/advisories/GHSA-w9pc-fmgc-vxvw.md)
  `GHSA-w9pc-fmgc-vxvw`, `CVE-2025-61771` · RubyGems `rack`: affected `<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2`, fixed in `2.2.19`, `3.1.17`, `3.2.2` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2025 · Tags: Denial of service
- [Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)](https://agentprime.io/advisories/GHSA-p543-xpfm-54cp.md)
  `GHSA-p543-xpfm-54cp`, `CVE-2025-61770` · RubyGems `rack`: affected `<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2`, fixed in `2.2.19`, `3.1.17`, `3.2.2` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2025 · Tags: Denial of service
- [Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters](https://agentprime.io/advisories/GHSA-625h-95r8-8xpm.md)
  `GHSA-625h-95r8-8xpm`, `CVE-2025-59830` · RubyGems `rack`: affected `<2.2.18`, fixed in `2.2.18` · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2025 · Tags: Denial of service
- [REXML has DoS condition when parsing malformed XML file](https://agentprime.io/advisories/GHSA-c2f4-jgmc-q2r5.md)
  `GHSA-c2f4-jgmc-q2r5`, `CVE-2025-58767` · RubyGems `rexml`: affected `>=3.3.3, <3.4.2`, fixed in `3.4.2` · CVSS 1.2 Low · Not analysed yet · Published 17 Sept 2025 · Tags: Denial of service
- [Google Sign-In for Rails allowed redirect to protocol-relative URI](https://agentprime.io/advisories/GHSA-5jch-xhw4-r43v.md)
  `GHSA-5jch-xhw4-r43v`, `CVE-2025-58067` · RubyGems `google_sign_in`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 4.2 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: Open redirect
- [Google Sign-In for Rails allowed redirects to malformed URLs](https://agentprime.io/advisories/GHSA-7pwc-wh6m-44q3.md)
  `GHSA-7pwc-wh6m-44q3`, `CVE-2025-57821` · RubyGems `google_sign_in`: affected `<1.3.0`, fixed in `1.3.0` · CVSS 4.2 Medium · Not analysed yet · Published 27 Aug 2025 · Tags: Open redirect
- [Spree Commerce is vulnerable to RCE through Search API](https://agentprime.io/advisories/GHSA-x485-rhg3-cqr4.md)
  `GHSA-x485-rhg3-cqr4`, `CVE-2011-10026` · RubyGems `rd_searchlogic` and 1 more: affected `<=3.0.1`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2025 · Tags: Command injection, Code injection
- [Active Storage allowed transformation methods that were potentially unsafe](https://agentprime.io/advisories/GHSA-r4mg-4433-c7g3.md)
  `GHSA-r4mg-4433-c7g3`, `CVE-2025-24293` · RubyGems `activestorage`: affected `>=5.2.0, <7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1`, fixed in `7.1.5.2`, `7.2.2.2`, `8.0.2.1` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2025 · Tags: Command injection, Code injection
- [Active Record logging vulnerable to ANSI escape injection](https://agentprime.io/advisories/GHSA-76r7-hhxj-r776.md)
  `GHSA-76r7-hhxj-r776`, `CVE-2025-55193` · RubyGems `activerecord`: affected `<7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1`, fixed in `7.1.5.2`, `7.2.2.2`, `8.0.2.1` · CVSS 2.7 Low · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-150
- [Spree has Remote Command Execution vulnerability in search functionality](https://agentprime.io/advisories/GHSA-97vm-c39p-jr86.md)
  `GHSA-97vm-c39p-jr86`, `CVE-2011-10019` · RubyGems `spree`: affected `<0.60.2`, fixed in `0.60.2` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: Code injection, Prototype pollution
- [JWE is missing AES-GCM authentication tag validation in encrypted JWE](https://agentprime.io/advisories/GHSA-c7p4-hx26-pr73.md)
  `GHSA-c7p4-hx26-pr73`, `CVE-2025-54887` · RubyGems `jwe`: affected `<1.1.1`, fixed in `1.1.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2025 · Tags: CWE-354
- [Ruby SAML DOS vulnerability with large SAML response](https://agentprime.io/advisories/GHSA-rrqh-93c8-j966.md)
  `GHSA-rrqh-93c8-j966`, `CVE-2025-54572` · RubyGems `ruby-saml`: affected `<1.18.1`, fixed in `1.18.1` · CVSS 6.9 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: Denial of service
- [Nokogiri patches vendored libxml2 to resolve multiple CVEs](https://agentprime.io/advisories/GHSA-353f-x4gh-cqq8.md)
  `GHSA-353f-x4gh-cqq8` · RubyGems `nokogiri`: affected `<1.18.9`, fixed in `1.18.9` · No CVSS score · Not analysed yet · Published 21 Jul 2025
- [Withdrawn Advisory: Thor can construct an unsafe shell command from library input.](https://agentprime.io/advisories/GHSA-mqcp-p2hv-vw6x.md)
  `GHSA-mqcp-p2hv-vw6x`, `CVE-2025-54314` · RubyGems `thor`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 2.8 Low · Withdrawn · Not analysed yet · Published 20 Jul 2025 · Tags: Command injection
- [Measured is vulnerable to Path Traversal attacks during class initialization](https://agentprime.io/advisories/GHSA-29g5-m8v7-v564.md)
  `GHSA-29g5-m8v7-v564` · RubyGems `measured`: affected `<3.2.1`, fixed in `3.2.1` · CVSS 4.0, no score published · Not analysed yet · Published 15 Jul 2025 · Tags: Path traversal
- [resolv vulnerable to DoS via insufficient DNS domain name length validation](https://agentprime.io/advisories/GHSA-xh69-987w-hrp8.md)
  `GHSA-xh69-987w-hrp8`, `CVE-2025-24294` · RubyGems `resolv`: affected `<0.2.3 || >=0.3.0, <0.3.1 || >=0.4.0, <0.6.2`, fixed in `0.2.3`, `0.3.1`, `0.6.2` · CVSS 5.3 Medium · Not analysed yet · Published 15 Jul 2025 · Tags: Denial of service, CWE-1284
- [Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class](https://agentprime.io/advisories/GHSA-6qjf-g333-pv38.md)
  `GHSA-6qjf-g333-pv38`, `CVE-2025-53623` · RubyGems `job-iteration`: affected `<1.11`, fixed in `1.11` · CVSS 8.1 High · Not analysed yet · Published 14 Jul 2025 · Tags: Command injection
- [HashiCorp Vagrant has code injection vulnerability through default synced folders](https://agentprime.io/advisories/GHSA-hqp6-mjw3-f586.md)
  `GHSA-hqp6-mjw3-f586`, `CVE-2025-34075` · RubyGems `vagrant`: affected `>=2.2.10, <2.4.7`, fixed in `2.4.7` · CVSS 4.0, no score published · Not analysed yet · Published 2 Jul 2025 · Tags: Code injection, Broken access control, Information disclosure
- [Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-r995-q44h-hr64.md)
  `GHSA-r995-q44h-hr64`, `CVE-2025-6442` · RubyGems `webrick`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: HTTP request smuggling
- [sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow](https://agentprime.io/advisories/GHSA-jc9r-qcgw-fxq9.md)
  `GHSA-jc9r-qcgw-fxq9`, `CVE-2025-6494` · RubyGems `nokogiri`: affected `=0`, no fixed version yet · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 23 Jun 2025 · Tags: Memory corruption
- [sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow](https://agentprime.io/advisories/GHSA-pf9w-gvcf-gv7m.md)
  `GHSA-pf9w-gvcf-gv7m`, `CVE-2025-6490` · RubyGems `nokogiri`: affected `=0`, no fixed version yet · CVSS 4.8 Medium · Withdrawn · Not analysed yet · Published 22 Jun 2025 · Tags: Memory corruption
- [ReDoS Vulnerability in Rack::Multipart handle_mime_head](https://agentprime.io/advisories/GHSA-47m2-26rw-j2jw.md)
  `GHSA-47m2-26rw-j2jw`, `CVE-2025-49007` · RubyGems `rack`: affected `>=3.1.0, <3.1.16`, fixed in `3.1.16` · CVSS 6.6 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: Denial of service
- [Rack has an Unbounded-Parameter DoS in Rack::QueryParser](https://agentprime.io/advisories/GHSA-gjh7-p2fx-99vx.md)
  `GHSA-gjh7-p2fx-99vx`, `CVE-2025-46727` · RubyGems `rack`: affected `<2.2.14 || >=3.0, <3.0.16 || >=3.1, <3.1.14`, fixed in `2.2.14`, `3.0.16`, `3.1.14` · CVSS 7.5 High · Not analysed yet · Published 8 May 2025 · Tags: Denial of service
- [Rack session gets restored after deletion](https://agentprime.io/advisories/GHSA-9j94-67jr-4cqj.md)
  `GHSA-9j94-67jr-4cqj`, `CVE-2025-46336` · RubyGems `rack-session`: affected `>=2.0.0, <2.1.1`, fixed in `2.1.1` · CVSS 4.2 Medium · Not analysed yet · Published 8 May 2025 · Tags: Race condition, Authentication bypass
- [Rack session gets restored after deletion](https://agentprime.io/advisories/GHSA-vpfw-47h7-xj4g.md)
  `GHSA-vpfw-47h7-xj4g`, `CVE-2025-32441` · RubyGems `rack`: affected `<2.2.14`, fixed in `2.2.14` · CVSS 4.2 Medium · Not analysed yet · Published 8 May 2025 · Tags: Race condition, Authentication bypass
- [JRuby-OpenSSL has hostname verification disabled by default](https://agentprime.io/advisories/GHSA-72qj-48g4-5xgx.md)
  `GHSA-72qj-48g4-5xgx`, `CVE-2025-46551` · Maven `org.jruby:jruby` and 2 more: affected `>=10.0.0.0, <10.0.0.1 || >=9.3.4.0, <9.4.12.1`, fixed in `10.0.0.1`, `9.4.12.1` · CVSS 5.7 Medium · Not analysed yet · Published 7 May 2025 · Tags: Weak cryptography or TLS
- [net-imap rubygem vulnerable to possible DoS by memory exhaustion](https://agentprime.io/advisories/GHSA-j3g3-5qv5-52mj.md)
  `GHSA-j3g3-5qv5-52mj`, `CVE-2025-43857` · RubyGems `net-imap`: affected `<0.2.5 || >=0.3.0, <0.3.9 || >=0.4.0, <0.4.20 || >=0.5.0, <0.5.7`, fixed in `0.2.5`, `0.3.9`, `0.4.20`, `0.5.7` · CVSS 6.0 Medium · Not analysed yet · Published 28 Apr 2025 · Tags: Denial of service, CWE-405
- [Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415](https://agentprime.io/advisories/GHSA-5w6v-399v-w3cc.md)
  `GHSA-5w6v-399v-w3cc`, `CVE-2025-71346` · RubyGems `nokogiri`: affected `<1.18.8`, fixed in `1.18.8` · No CVSS score · Not analysed yet · Published 21 Apr 2025 · Tags: CWE-1395

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDI1LTA0LTIxVDIxOjU1OjU2LjAwMDAwMFoiLCJHSFNBLTV3NnYtMzk5di13M2NjIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDI2LTAyLTE3VDE4OjQ2OjM1LjAwMDAwMFoiLCJHSFNBLXdocmotNDQ3Ni13dm1wIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDI2LTAyLTE3VDE4OjQ2OjM1LjAwMDAwMFoiLCJHSFNBLXdocmotNDQ3Ni13dm1wIl0>. Everything for agents: <https://agentprime.io/llms.txt>.