# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [Open Redirect in ActionPack](https://agentprime.io/advisories/GHSA-2rqw-v265-jf8c.md)
  `GHSA-2rqw-v265-jf8c`, `CVE-2021-22942` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.4.1 || >=6.1.0, <6.1.4.1`, fixed in `6.0.4.1`, `6.1.4.1` · CVSS 6.1 Medium · Not analysed yet · Published 26 Aug 2021 · Tags: Open redirect
- [Cross-Site Scripting in Qiita-Markdown](https://agentprime.io/advisories/GHSA-f2c9-5jqw-3xh3.md)
  `GHSA-f2c9-5jqw-3xh3`, `CVE-2021-28796` · RubyGems `qiita-markdown`: affected `<0.33.0`, fixed in `0.33.0` · CVSS 6.1 Medium · Not analysed yet · Published 2 Aug 2021 · Tags: Cross-site scripting (XSS)
- [qiita-markdown Cross-site Scripting vulnerability](https://agentprime.io/advisories/GHSA-9p29-94hp-8rvc.md)
  `GHSA-9p29-94hp-8rvc`, `CVE-2021-28833` · RubyGems `qiita-markdown`: affected `<0.34.0`, fixed in `0.34.0` · CVSS 6.1 Medium · Not analysed yet · Published 2 Aug 2021 · Tags: Cross-site scripting (XSS)
- [Regular Expression Denial of Service in Addressable templates](https://agentprime.io/advisories/GHSA-jxhc-q857-3j6g.md)
  `GHSA-jxhc-q857-3j6g`, `CVE-2021-32740` · RubyGems `addressable`: affected `>=2.3.0, <2.8.0`, fixed in `2.8.0` · CVSS 7.5 High · Not analysed yet · Published 12 Jul 2021 · Tags: Denial of service
- [Code injection in Narou](https://agentprime.io/advisories/GHSA-gwrj-88fp-5m36.md)
  `GHSA-gwrj-88fp-5m36`, `CVE-2021-35514` · RubyGems `narou`: affected `<3.8.0`, fixed in `3.8.0` · CVSS 8.5 High · Not analysed yet · Published 2 Jul 2021 · Tags: Code injection
- [Potential Denial-of-Service in bindata](https://agentprime.io/advisories/GHSA-hj56-84jw-67h6.md)
  `GHSA-hj56-84jw-67h6`, `BIT-gitlab-2021-32823`, `CVE-2021-32823` · RubyGems `bindata`: affected `<2.4.10`, fixed in `2.4.10` · CVSS 3.7 Low · Not analysed yet · Published 23 Jun 2021 · Tags: Denial of service
- [Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox](https://agentprime.io/advisories/GHSA-f2rp-4rv7-fc95.md)
  `GHSA-f2rp-4rv7-fc95`, `CVE-2021-20259` · RubyGems `foreman_fog_proxmox`: affected `<0.13.1`, fixed in `0.13.1` · CVSS 7.8 High · Not analysed yet · Published 10 Jun 2021 · Tags: Information disclosure
- [Dragonfly contains remote code execution vulnerability](https://agentprime.io/advisories/GHSA-j858-xp5v-f8xx.md)
  `GHSA-j858-xp5v-f8xx`, `CVE-2021-33564` · RubyGems `dragonfly`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.72 · Not analysed yet · Published 2 Jun 2021 · Tags: Command injection, Code injection
- [HTTP Request Smuggling in goliath](https://agentprime.io/advisories/GHSA-3892-2r52-p65m.md)
  `GHSA-3892-2r52-p65m`, `CVE-2020-7671`, `SNYK-RUBY-GOLIATH-569136` · RubyGems `goliath`: affected `<=1.0.6`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 May 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in reel](https://agentprime.io/advisories/GHSA-x3v4-pxvm-63j8.md)
  `GHSA-x3v4-pxvm-63j8`, `CVE-2020-7659`, `SNYK-RUBY-REEL-569135` · RubyGems `reel`: affected `<=0.6.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 May 2021 · Tags: HTTP request smuggling
- [Improper Certificate Validation in EM-HTTP-Request](https://agentprime.io/advisories/GHSA-q27f-v3r6-9v77.md)
  `GHSA-q27f-v3r6-9v77`, `CVE-2020-13482` · RubyGems `em-http-request`: affected `<1.1.6`, fixed in `1.1.6` · CVSS 7.4 High · Not analysed yet · Published 24 May 2021 · Tags: Weak cryptography or TLS
- [Dependency Confusion in Bundler](https://agentprime.io/advisories/GHSA-fp4w-jxhp-m23p.md)
  `GHSA-fp4w-jxhp-m23p`, `CVE-2020-36327` · RubyGems `bundler`: affected `>=1.16.0, <2.2.10 || >=2.2.11, <2.2.18`, fixed in `2.2.10`, `2.2.18` · CVSS 8.8 High · Not analysed yet · Published 24 May 2021
- [Improper certificate validation in em-imap](https://agentprime.io/advisories/GHSA-4f68-49qq-h392.md)
  `GHSA-4f68-49qq-h392`, `CVE-2020-13163` · RubyGems `em-imap`: affected `<=0.5`, no fixed version yet · CVSS 7.4 High · Not analysed yet · Published 24 May 2021 · Tags: Weak cryptography or TLS
- [Puma's Keepalive Connections Causing Denial Of Service](https://agentprime.io/advisories/GHSA-q28m-8xjw-8vr5.md)
  `GHSA-q28m-8xjw-8vr5`, `CVE-2021-29509` · RubyGems `puma`: affected `<4.3.8 || >=5.0.0, <5.3.1`, fixed in `4.3.8`, `5.3.1` · CVSS 7.5 High · Not analysed yet · Published 18 May 2021 · Tags: Denial of service
- [Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12](https://agentprime.io/advisories/GHSA-7rrm-v45f-jp64.md)
  `GHSA-7rrm-v45f-jp64`, `CVE-2021-47996` · RubyGems `nokogiri`: affected `<1.11.4`, fixed in `1.11.4` · No CVSS score · Not analysed yet · Published 17 May 2021
- [Insecure path handling in Bundler](https://agentprime.io/advisories/GHSA-g98m-96g9-wfjq.md)
  `GHSA-g98m-96g9-wfjq`, `CVE-2019-3881` · RubyGems `bundler`: affected `>=1.14.0, <2.1.0`, fixed in `2.1.0` · CVSS 7.0 High · Not analysed yet · Published 10 May 2021 · Tags: Information disclosure, CWE-427
- [Command Injection in lodash](https://agentprime.io/advisories/GHSA-35jh-r3h4-6jhm.md)
  `GHSA-35jh-r3h4-6jhm`, `CVE-2021-23337` · npm `lodash` and 4 more: affected `<4.17.21`, fixed in `4.17.21` · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.20 · Not analysed yet · Published 6 May 2021 · Tags: Command injection, Code injection
- [Tempfile on Windows path traversal vulnerability](https://agentprime.io/advisories/GHSA-46f2-3v63-3xrp.md)
  `GHSA-46f2-3v63-3xrp`, `BIT-ruby-2021-28966`, `BIT-ruby-min-2021-28966`, `CVE-2021-28966` · RubyGems `tmpdir`: affected `<0.1.2`, fixed in `0.1.2` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.58 · Not analysed yet · Published 6 May 2021 · Tags: Path traversal
- [Possible DoS Vulnerability in Action Controller Token Authentication](https://agentprime.io/advisories/GHSA-7wjx-3g7j-8584.md)
  `GHSA-7wjx-3g7j-8584`, `CVE-2021-22904` · RubyGems `actionpack`: affected `>=4.0.0, <5.2.4.6 || >=5.2.5, <5.2.6 || >=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2`, fixed in `5.2.4.6`, `5.2.6`, `6.0.3.7`, `6.1.3.2` · CVSS 7.5 High · Not analysed yet · Published 5 May 2021 · Tags: Denial of service
- [Action Pack contains Information Disclosure / Unintended Method Execution vulnerability](https://agentprime.io/advisories/GHSA-hjg4-8q5f-x6fm.md)
  `GHSA-hjg4-8q5f-x6fm`, `CVE-2021-22885` · RubyGems `actionpack`: affected `>=2.0.0, <5.2.4.6 || >=5.2.5, <5.2.6 || >=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2`, fixed in `5.2.4.6`, `5.2.6`, `6.0.3.7`, `6.1.3.2` · CVSS 7.5 High · Not analysed yet · Published 5 May 2021 · Tags: Information disclosure
- [Possible Open Redirect Vulnerability in Action Pack](https://agentprime.io/advisories/GHSA-5hq2-xf89-9jxq.md)
  `GHSA-5hq2-xf89-9jxq`, `CVE-2021-22903` · RubyGems `actionpack`: affected `>=6.1.0.rc2, <6.1.3.2`, fixed in `6.1.3.2` · CVSS 6.1 Medium · Not analysed yet · Published 5 May 2021 · Tags: Open redirect
- [Denial of Service in Action Dispatch](https://agentprime.io/advisories/GHSA-g8ww-46x2-2p65.md)
  `GHSA-g8ww-46x2-2p65`, `CVE-2021-22902` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.3.7 || >=6.1.0, <6.1.3.2`, fixed in `6.0.3.7`, `6.1.3.2` · CVSS 7.5 High · Not analysed yet · Published 5 May 2021 · Tags: Denial of service
- [REXML round-trip instability](https://agentprime.io/advisories/GHSA-8cr8-4vfw-mr7h.md)
  `GHSA-8cr8-4vfw-mr7h`, `BIT-ruby-2021-28965`, `BIT-ruby-min-2021-28965`, `CVE-2021-28965` · RubyGems `rexml`: affected `<3.2.5`, fixed in `3.2.5` · CVSS 7.5 High · Not analysed yet · Published 30 Apr 2021 · Tags: XML external entities (XXE), CWE-115
- [Gon gem lack of escaping certain input when outputting as JSON](https://agentprime.io/advisories/GHSA-78vq-9j56-wrfr.md)
  `GHSA-78vq-9j56-wrfr`, `CVE-2020-25739` · RubyGems `gon`: affected `<6.4.0`, fixed in `6.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 30 Apr 2021 · Tags: Cross-site scripting (XSS)
- [Pgsync Contains Cleartext Transmission of Sensitive Information](https://agentprime.io/advisories/GHSA-72rj-36qc-47g7.md)
  `GHSA-72rj-36qc-47g7`, `CVE-2021-31671` · RubyGems `pgsync`: affected `<0.6.7`, fixed in `0.6.7` · CVSS 7.5 High · Not analysed yet · Published 27 Apr 2021 · Tags: Weak cryptography or TLS
- [Improper Certificate Validation in oauth ruby gem](https://agentprime.io/advisories/GHSA-7359-3c6r-hfc2.md)
  `GHSA-7359-3c6r-hfc2`, `CVE-2016-11086` · RubyGems `oauth`: affected `<0.5.5`, fixed in `0.5.5` · CVSS 7.4 High · Not analysed yet · Published 22 Apr 2021 · Tags: Weak cryptography or TLS
- [Cross-Site Request Forgery (CSRF) in trestle-auth](https://agentprime.io/advisories/GHSA-h8hx-2c5r-32cf.md)
  `GHSA-h8hx-2c5r-32cf`, `CVE-2021-29435` · RubyGems `trestle-auth`: affected `>=0.4.0, <0.4.2`, fixed in `0.4.2` · CVSS 8.1 High · Not analysed yet · Published 13 Apr 2021 · Tags: Cross-site request forgery (CSRF)
- [Improper Certificate Validation in TweetStream](https://agentprime.io/advisories/GHSA-6hrm-jqp3-64cv.md)
  `GHSA-6hrm-jqp3-64cv`, `CVE-2020-24393` · RubyGems `tweetstream`: affected `<=2.6.1`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 13 Apr 2021 · Tags: Weak cryptography or TLS
- [Improper Certificate Validation in Puppet](https://agentprime.io/advisories/GHSA-gqvf-892r-vjm5.md)
  `GHSA-gqvf-892r-vjm5`, `CVE-2020-7942` · RubyGems `puppet`: affected `<5.5.19 || >=6.0.0, <6.13.0`, fixed in `5.5.19`, `6.13.0` · CVSS 6.5 Medium · Not analysed yet · Published 13 Apr 2021 · Tags: Weak cryptography or TLS
- [Cross-site scripting in actionpack](https://agentprime.io/advisories/GHSA-35mm-cc6r-8fjp.md)
  `GHSA-35mm-cc6r-8fjp`, `CVE-2020-8264` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.3.4`, fixed in `6.0.3.4` · CVSS 6.1 Medium · EPSS 0.67 · Not analysed yet · Published 7 Apr 2021 · Tags: Cross-site scripting (XSS)
- [Remote code execution in Kramdown](https://agentprime.io/advisories/GHSA-52p9-v744-mwjj.md)
  `GHSA-52p9-v744-mwjj`, `CVE-2021-28834` · RubyGems `kramdown`: affected `>=1.16.0, <2.3.1`, fixed in `2.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Mar 2021 · Tags: Code injection
- [Improper Certificate Validation in twitter-stream](https://agentprime.io/advisories/GHSA-p6p8-q4pj-f74m.md)
  `GHSA-p6p8-q4pj-f74m`, `CVE-2020-24392` · RubyGems `twitter-stream`: affected `<=0.1.16`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 29 Mar 2021 · Tags: Weak cryptography or TLS
- [Activerecord-session_store Vulnerable to Timing Attack](https://agentprime.io/advisories/GHSA-cvw2-xj8r-mjf7.md)
  `GHSA-cvw2-xj8r-mjf7`, `CVE-2019-25025` · RubyGems `activerecord-session_store`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Mar 2021 · Tags: CWE-208
- [Actionpack Open Redirect Vulnerability](https://agentprime.io/advisories/GHSA-8877-prq4-9xfw.md)
  `GHSA-8877-prq4-9xfw`, `CVE-2021-22881` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.3.5 || >=6.1.0, <6.1.2.1`, fixed in `6.0.3.5`, `6.1.2.1` · CVSS 6.1 Medium · EPSS 0.87 · Not analysed yet · Published 2 Mar 2021 · Tags: Open redirect
- [Active Record subject to Regular Expression Denial-of-Service (ReDoS)](https://agentprime.io/advisories/GHSA-8hc4-xxm3-5ppp.md)
  `GHSA-8hc4-xxm3-5ppp`, `CVE-2021-22880` · RubyGems `activerecord`: affected `>=5.0.0, <5.2.4.5 || >=6.0.0, <6.0.3.5 || >=6.1.0, <6.1.2.1`, fixed in `5.2.4.5`, `6.0.3.5`, `6.1.2.1` · CVSS 7.5 High · Not analysed yet · Published 2 Mar 2021 · Tags: Denial of service
- [Cross-Site Request Forgery (CSRF)](https://agentprime.io/advisories/GHSA-wj5j-xpcj-45gc.md)
  `GHSA-wj5j-xpcj-45gc` · RubyGems `devise_invitable`: affected `<1.3.5`, fixed in `1.3.5` · No CVSS score · Withdrawn · Not analysed yet · Published 24 Feb 2021 · Tags: Cross-site request forgery (CSRF)
- [Backdoor / Malicious code](https://agentprime.io/advisories/GHSA-q2hm-gx3f-h63q.md)
  `GHSA-q2hm-gx3f-h63q` · RubyGems `lita-coin`: affected `=0.0.3`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 23 Feb 2021
- [Code Injection vulnerability in CarrierWave::RMagick](https://agentprime.io/advisories/GHSA-cf3w-g86h-35x4.md)
  `GHSA-cf3w-g86h-35x4`, `CVE-2021-21305` · RubyGems `carrierwave`: affected `<1.3.2 || >=2.0.0, <2.1.1`, fixed in `1.3.2`, `2.1.1` · CVSS 7.4 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 8 Feb 2021 · Tags: Other injection, Code injection
- [Server-side request forgery in CarrierWave](https://agentprime.io/advisories/GHSA-fwcm-636p-68r5.md)
  `GHSA-fwcm-636p-68r5`, `CVE-2021-21288` · RubyGems `carrierwave`: affected `<1.3.2 || >=2.0.0, <2.1.1`, fixed in `1.3.2`, `2.1.1` · CVSS 4.3 Medium · Not analysed yet · Published 8 Feb 2021 · Tags: Server-side request forgery (SSRF)
- [Command Injection Vulnerability in Mechanize](https://agentprime.io/advisories/GHSA-qrqm-fpv6-6r8g.md)
  `GHSA-qrqm-fpv6-6r8g`, `CVE-2021-21289` · RubyGems `mechanize`: affected `>=2.0.0, <2.7.7`, fixed in `2.7.7` · CVSS 7.4 High · Not analysed yet · Published 2 Feb 2021 · Tags: Command injection
- [rails_admin ruby gem XSS vulnerability](https://agentprime.io/advisories/GHSA-wjx2-7hqq-8h7m.md)
  `GHSA-wjx2-7hqq-8h7m`, `CVE-2020-36190` · RubyGems `rails_admin`: affected `<1.4.3 || >=2.0.0, <2.0.2`, fixed in `1.4.3`, `2.0.2` · CVSS 6.1 Medium · Not analysed yet · Published 14 Jan 2021 · Tags: Cross-site scripting (XSS)
- [Injection/XSS in Redcarpet](https://agentprime.io/advisories/GHSA-q3wr-qw3g-3p4h.md)
  `GHSA-q3wr-qw3g-3p4h`, `CVE-2020-26298` · RubyGems `redcarpet`: affected `<3.5.1`, fixed in `3.5.1` · CVSS 6.8 Medium · Not analysed yet · Published 11 Jan 2021 · Tags: Other injection, Cross-site scripting (XSS)
- [Nokogiri::XML::Schema trusts input by default, exposing risk of XXE vulnerability](https://agentprime.io/advisories/GHSA-vr8q-g5c7-m54m.md)
  `GHSA-vr8q-g5c7-m54m`, `CVE-2020-26247` · RubyGems `nokogiri`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 2.6 Low · Not analysed yet · Published 30 Dec 2020 · Tags: XML external entities (XXE)
- [omniauth-apple allows attacker to fake their email address during authentication](https://agentprime.io/advisories/GHSA-49r3-2549-3633.md)
  `GHSA-49r3-2549-3633`, `CVE-2020-26254` · RubyGems `omniauth-apple`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 7.7 High · Not analysed yet · Published 8 Dec 2020 · Tags: Authentication bypass
- [Authorization bypass in Spree](https://agentprime.io/advisories/GHSA-m2jr-hmc3-qmpr.md)
  `GHSA-m2jr-hmc3-qmpr`, `CVE-2020-26223` · RubyGems `spree_api`: affected `>=3.7.0, <3.7.13 || >=4.0.0, <4.0.5 || >=4.1.0, <4.1.12`, fixed in `3.7.13`, `4.0.5`, `4.1.12` · CVSS 7.7 High · Not analysed yet · Published 13 Nov 2020 · Tags: Broken access control
- [Remote code execution in dependabot-core branch names when cloning](https://agentprime.io/advisories/GHSA-23f7-99jx-m54r.md)
  `GHSA-23f7-99jx-m54r`, `CVE-2020-26222` · RubyGems `dependabot-common` and 1 more: affected `>=0.119.0.beta1, <0.125.1`, fixed in `0.125.1` · CVSS 8.7 High · Not analysed yet · Published 13 Nov 2020 · Tags: Other injection
- [Regression in JWT Signature Validation](https://agentprime.io/advisories/GHSA-58r4-h6v8-jcvm.md)
  `GHSA-58r4-h6v8-jcvm`, `CVE-2020-15240` · RubyGems `omniauth-auth0`: affected `>=2.3.0, <2.4.1`, fixed in `2.4.1` · CVSS 7.4 High · Not analysed yet · Published 3 Nov 2020 · Tags: Authentication bypass, Weak cryptography or TLS
- [Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls](https://agentprime.io/advisories/GHSA-f8cm-364f-q9qh.md)
  `GHSA-f8cm-364f-q9qh`, `CVE-2020-15269` · RubyGems `spree`: affected `<3.7.11 || >=4.0.0, <4.0.4 || >=4.1.0, <4.1.11`, fixed in `3.7.11`, `4.0.4`, `4.1.11` · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2020 · Tags: Authentication bypass
- [Withdrawn: HTTP Request Smuggling in Agoo](https://agentprime.io/advisories/GHSA-h385-52j6-9984.md)
  `GHSA-h385-52j6-9984`, `CVE-2020-7670` · RubyGems `agoo`: affected `<=2.13.0`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 20 Oct 2020 · Tags: HTTP request smuggling
- [Possible timing attack in derivation_endpoint](https://agentprime.io/advisories/GHSA-5jjv-x4fq-qjwp.md)
  `GHSA-5jjv-x4fq-qjwp`, `CVE-2020-15237` · RubyGems `shrine`: affected `<3.3.0`, fixed in `3.3.0` · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2020 · Tags: Information disclosure, CWE-208
- [personnummer/ruby vulnerable to Improper Input Validation](https://agentprime.io/advisories/GHSA-vp9c-fpxx-744v.md)
  `GHSA-vp9c-fpxx-744v` · RubyGems `personnummer`: affected `<3.0.1`, fixed in `3.0.1` · No CVSS score · Not analysed yet · Published 23 Sept 2020
- [XSS in Action View](https://agentprime.io/advisories/GHSA-cfjv-5498-mph5.md)
  `GHSA-cfjv-5498-mph5`, `CVE-2020-15169` · RubyGems `actionview`: affected `<5.2.4.4 || >=6.0.0.0, <6.0.3.3`, fixed in `5.2.4.4`, `6.0.3.3` · CVSS 5.4 Medium · Not analysed yet · Published 11 Sept 2020 · Tags: Cross-site scripting (XSS)
- [Cross-Site Scripting in jquery](https://agentprime.io/advisories/GHSA-2pqj-h3vj-pqgw.md)
  `GHSA-2pqj-h3vj-pqgw`, `CVE-2012-6708` · Maven `org.webjars.npm:jquery` and 3 more: affected `<1.9.0`, fixed in `1.9.0` · CVSS 6.1 Medium · Not analysed yet · Published 1 Sept 2020 · Tags: Cross-site scripting (XSS), CWE-64
- [Moped Rubygem Data Injection Vulnerability](https://agentprime.io/advisories/GHSA-f93j-hmcr-jcwh.md)
  `GHSA-f93j-hmcr-jcwh`, `CVE-2015-4410` · RubyGems `moped`: affected `<1.5.3 || >=2.0.0, <2.0.5`, fixed in `1.5.3`, `2.0.5` · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2020 · Tags: CWE-20
- [CSS Injection in Chartkick gem](https://agentprime.io/advisories/GHSA-3j95-fjv2-3m4p.md)
  `GHSA-3j95-fjv2-3m4p`, `CVE-2020-16254` · RubyGems `chartkick`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 6.1 Medium · Not analysed yet · Published 12 Aug 2020 · Tags: Other injection
- [Unintended read access in kramdown gem](https://agentprime.io/advisories/GHSA-mqm2-cgpr-p4m6.md)
  `GHSA-mqm2-cgpr-p4m6`, `CVE-2020-14001` · RubyGems `kramdown`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Aug 2020 · Tags: Broken access control
- [PgHero gem allows CSRF](https://agentprime.io/advisories/GHSA-v6fx-752r-ccp2.md)
  `GHSA-v6fx-752r-ccp2`, `CVE-2020-16253` · RubyGems `pghero`: affected `<2.7.0`, fixed in `2.7.0` · CVSS 8.1 High · Not analysed yet · Published 5 Aug 2020 · Tags: Cross-site request forgery (CSRF)
- [Field Test CSRF vulnerability](https://agentprime.io/advisories/GHSA-w542-cpp9-r3g7.md)
  `GHSA-w542-cpp9-r3g7`, `CVE-2020-16252` · RubyGems `field_test`: affected `>=0.2.0, <0.4.0`, fixed in `0.4.0` · CVSS 4.3 Medium · Not analysed yet · Published 5 Aug 2020 · Tags: Cross-site request forgery (CSRF)
- [Ability to change order address without triggering address validations in solidus](https://agentprime.io/advisories/GHSA-3mvg-rrrw-m7ph.md)
  `GHSA-3mvg-rrrw-m7ph`, `CVE-2020-15109` · RubyGems `solidus_api` and 1 more: affected `<2.8.6 || >=2.9.0, <2.9.6 || >=2.10.0, <2.10.2`, fixed in `2.8.6`, `2.9.6`, `2.10.2` · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2020 · Tags: Broken access control, CWE-20
- [Missing TLS certificate verification in faye-websocket](https://agentprime.io/advisories/GHSA-2v5c-755p-p4gv.md)
  `GHSA-2v5c-755p-p4gv`, `CVE-2020-15133` · RubyGems `faye-websocket`: affected `<0.11.0`, fixed in `0.11.0` · CVSS 8.0 High · Not analysed yet · Published 31 Jul 2020 · Tags: Weak cryptography or TLS

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIwLTA3LTMxVDE3OjQwOjA0LjAwMDAwMFoiLCJHSFNBLTJ2NWMtNzU1cC1wNGd2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIxLTA5LTAxVDE4OjUzOjE1LjAwMDAwMFoiLCJHSFNBLWdneG0tcGdjOS1nN2ZwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIxLTA5LTAxVDE4OjUzOjE1LjAwMDAwMFoiLCJHSFNBLWdneG0tcGdjOS1nN2ZwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.