# RubyGems Advisories.

Every RubyGems Advisory we hold (Ruby), newest first.

## Records, newest first (an older page)

- [RubyGems passenger gem allows remote attackers to delete files](https://agentprime.io/advisories/GHSA-8mw8-j583-vqfg.md)
  `GHSA-8mw8-j583-vqfg`, `CVE-2012-6135` · RubyGems `passenger`: affected `<4.0.0.rc4`, fixed in `4.0.0.rc4` · CVSS 7.5 High · Not analysed yet · Published 23 Apr 2022 · Tags: CWE-20
- [Cross site scripting in actionpack Rubygem](https://agentprime.io/advisories/GHSA-q58j-fmvf-9rq6.md)
  `GHSA-q58j-fmvf-9rq6`, `CVE-2011-1497` · RubyGems `actionpack`: affected `>=3.0.0.rc, <3.0.6`, fixed in `3.0.6` · CVSS 6.1 Medium · Not analysed yet · Published 22 Apr 2022 · Tags: Cross-site scripting (XSS)
- [SQL injection in blazer](https://agentprime.io/advisories/GHSA-qf9q-q4hh-qph3.md)
  `GHSA-qf9q-q4hh-qph3`, `CVE-2022-29498` · RubyGems `blazer`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 7.5 High · Not analysed yet · Published 22 Apr 2022 · Tags: SQL injection
- [Command injection in ruby-git](https://agentprime.io/advisories/GHSA-69p6-wvmq-27gg.md)
  `GHSA-69p6-wvmq-27gg`, `BIT-git-2022-25648`, `CVE-2022-25648`, `SNYK-RUBY-GIT-2421270` · RubyGems `git`: affected `<1.11.0`, fixed in `1.11.0` · CVSS 8.1 High · Not analysed yet · Published 20 Apr 2022 · Tags: Command injection
- [Denial of Service (DoS) in Nokogiri on JRuby](https://agentprime.io/advisories/GHSA-gx8x-g87m-h5q6.md)
  `GHSA-gx8x-g87m-h5q6` · RubyGems `nokogiri`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2022 · Tags: Denial of service
- [XML Injection in Xerces Java affects Nokogiri](https://agentprime.io/advisories/GHSA-xxx9-3xcr-gjj3.md)
  `GHSA-xxx9-3xcr-gjj3` · RubyGems `nokogiri`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 6.5 Medium · Not analysed yet · Published 11 Apr 2022 · Tags: Other injection
- [Out-of-bounds Write in zlib affects Nokogiri](https://agentprime.io/advisories/GHSA-v6gp-9mmm-c6p5.md)
  `GHSA-v6gp-9mmm-c6p5` · RubyGems `nokogiri`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2022 · Tags: Memory corruption
- [Nokogiri Inefficient Regular Expression Complexity](https://agentprime.io/advisories/GHSA-crjr-9rc5-ghw8.md)
  `GHSA-crjr-9rc5-ghw8`, `CVE-2022-24836` · RubyGems `nokogiri`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 7.5 High · Not analysed yet · Published 11 Apr 2022 · Tags: Denial of service
- [Improper one time password handling in devise-two-factor](https://agentprime.io/advisories/GHSA-jm35-h8q2-73mp.md)
  `GHSA-jm35-h8q2-73mp`, `CVE-2021-43177` · RubyGems `devise-two-factor`: affected `<4.0.2`, fixed in `4.0.2` · CVSS 5.3 Medium · Not analysed yet · Published 7 Apr 2022 · Tags: CWE-254
- [Buffer Overflow in yajl-ruby](https://agentprime.io/advisories/GHSA-jj47-x69x-mxrm.md)
  `GHSA-jj47-x69x-mxrm`, `CVE-2022-24795` · RubyGems `yajl-ruby`: affected `<1.4.3`, fixed in `1.4.3` · CVSS 5.9 Medium · Not analysed yet · Published 5 Apr 2022 · Tags: Memory corruption
- [Command injection in cocoapods-downloader](https://agentprime.io/advisories/GHSA-g397-v4w5-4m79.md)
  `GHSA-g397-v4w5-4m79`, `CVE-2022-21223`, `SNYK-RUBY-COCOAPODSDOWNLOADER-2414280` · RubyGems `cocoapods-downloader`: affected `<1.6.2`, fixed in `1.6.2` · CVSS 8.1 High · Not analysed yet · Published 2 Apr 2022 · Tags: Other injection, Command injection
- [Command injection in cocoapods-downloader](https://agentprime.io/advisories/GHSA-7627-mp87-jf6q.md)
  `GHSA-7627-mp87-jf6q`, `CVE-2022-24440`, `SNYK-RUBY-COCOAPODSDOWNLOADER-2414278` · RubyGems `cocoapods-downloader`: affected `<1.6.0 || >=1.6.2, <1.6.3`, fixed in `1.6.0`, `1.6.3` · CVSS 8.1 High · Not analysed yet · Published 2 Apr 2022 · Tags: Other injection, Command injection
- [Command Injection vulnerability in asciidoctor-include-ext](https://agentprime.io/advisories/GHSA-v222-6mr4-qj29.md)
  `GHSA-v222-6mr4-qj29`, `CVE-2022-24803` · RubyGems `asciidoctor-include-ext`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2022 · Tags: Command injection
- [Puma vulnerable to HTTP Request Smuggling](https://agentprime.io/advisories/GHSA-h99w-9q5r-gjq9.md)
  `GHSA-h99w-9q5r-gjq9`, `CVE-2022-24790` · RubyGems `puma`: affected `<4.3.12 || >=5.0.0, <5.6.4`, fixed in `4.3.12`, `5.6.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2022 · Tags: HTTP request smuggling
- [Nokogiri affected by zlib's Out-of-bounds Write vulnerability](https://agentprime.io/advisories/GHSA-jc36-42cf-vqwj.md)
  `GHSA-jc36-42cf-vqwj`, `CVE-2018-25032`, `PSF-2022-3` · RubyGems `nokogiri`: affected `<1.13.4`, fixed in `1.13.4` · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.52 · Not analysed yet · Published 26 Mar 2022 · Tags: Memory corruption
- [Improper Certificate Validation in kubeclient](https://agentprime.io/advisories/GHSA-69p3-xp37-f692.md)
  `GHSA-69p3-xp37-f692`, `CVE-2022-0759` · RubyGems `kubeclient`: affected `<4.9.3`, fixed in `4.9.3` · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2022 · Tags: Weak cryptography or TLS
- [Missing Authentication for Critical Function in Foreman Ansible](https://agentprime.io/advisories/GHSA-vvff-6wrr-4g7q.md)
  `GHSA-vvff-6wrr-4g7q`, `CVE-2021-3589` · RubyGems `foreman_ansible`: affected `<2.0.0`, fixed in `2.0.0` · CVSS 8.0 High · Not analysed yet · Published 24 Mar 2022 · Tags: Authentication bypass
- [Possible code injection vulnerability in Rails / Active Storage](https://agentprime.io/advisories/GHSA-w749-p3v6-hccq.md)
  `GHSA-w749-p3v6-hccq`, `CVE-2022-21831` · RubyGems `activestorage`: affected `>=5.2.0, <5.2.6.3 || >=6.0.0, <6.0.4.7 || >=6.1.0, <6.1.4.7 || >=7.0.0, <7.0.2.3`, fixed in `5.2.6.3`, `6.0.4.7`, `6.1.4.7`, `7.0.2.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Mar 2022 · Tags: Code injection
- [Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption](https://agentprime.io/advisories/GHSA-fmx4-26r3-wxpf.md)
  `GHSA-fmx4-26r3-wxpf`, `CVE-2024-22051` · RubyGems `commonmarker`: affected `<0.23.4`, fixed in `0.23.4` · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2022 · Tags: Memory corruption
- [Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component](https://agentprime.io/advisories/GHSA-cm9w-c4rj-r2cf.md)
  `GHSA-cm9w-c4rj-r2cf`, `CVE-2022-24722` · RubyGems `view_component`: affected `>=2.31.0, <2.31.2 || >=2.32.0, <2.49.1`, fixed in `2.31.2`, `2.49.1` · CVSS 8.1 High · Not analysed yet · Published 2 Mar 2022 · Tags: Cross-site scripting (XSS)
- [Remote shell execution vulnerability in image_processing](https://agentprime.io/advisories/GHSA-cxf7-qrc5-9446.md)
  `GHSA-cxf7-qrc5-9446`, `CVE-2022-24720` · RubyGems `image_processing`: affected `<1.12.2`, fixed in `1.12.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Mar 2022 · Tags: Command injection, CWE-20
- [Vulnerable dependencies in Nokogiri](https://agentprime.io/advisories/GHSA-fq42-c5rg-92c2.md)
  `GHSA-fq42-c5rg-92c2`, `CVE-2022-51000` · RubyGems `nokogiri`: affected `<1.13.2`, fixed in `1.13.2` · No CVSS score · Not analysed yet · Published 25 Feb 2022 · Tags: Memory corruption
- [Hub Package Arbitrary File Overwrite](https://agentprime.io/advisories/GHSA-x5m6-jh4r-34mv.md)
  `GHSA-x5m6-jh4r-34mv`, `CVE-2014-0177` · Go `github.com/github/hub` and 1 more: affected `<1.12.1`, fixed in `1.12.1` · CVSS 4.4 Medium · Not analysed yet · Published 15 Feb 2022 · Tags: CWE-377
- [Puma used with Rails may lead to Information Exposure](https://agentprime.io/advisories/GHSA-rmj8-8hhh-gv5h.md)
  `GHSA-rmj8-8hhh-gv5h`, `CVE-2022-23634` · RubyGems `puma`: affected `<4.3.11 || >=5.0.0, <5.6.2`, fixed in `4.3.11`, `5.6.2` · CVSS 8.0 High · Not analysed yet · Published 11 Feb 2022 · Tags: Information disclosure, Denial of service
- [Exposure of information in Action Pack](https://agentprime.io/advisories/GHSA-wh98-p28r-vrc9.md)
  `GHSA-wh98-p28r-vrc9`, `CVE-2022-23633` · RubyGems `actionpack`: affected `>=5.0.0.0, <5.2.6.2 || >=6.0.0.0, <6.0.4.6 || >=6.1.0.0, <6.1.4.6 || >=7.0.0.0, <7.0.2.2`, fixed in `5.2.6.2`, `6.0.4.6`, `6.1.4.6`, `7.0.2.2` · CVSS 7.4 High · Not analysed yet · Published 11 Feb 2022 · Tags: Information disclosure, CWE-212
- [Publify Business Logic Errors](https://agentprime.io/advisories/GHSA-x3rq-r3cm-5vc4.md)
  `GHSA-x3rq-r3cm-5vc4`, `BIT-publify-2022-0524`, `CVE-2022-0524` · RubyGems `publify_core`: affected `<9.2.7`, fixed in `9.2.7` · CVSS 6.5 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-840, CWE-841
- [Denial of service in sidekiq](https://agentprime.io/advisories/GHSA-jrfj-98qg-qjgv.md)
  `GHSA-jrfj-98qg-qjgv`, `CVE-2022-23837` · RubyGems `sidekiq`: affected `<5.2.10 || >=6.0.0, <6.4.0`, fixed in `5.2.10`, `6.4.0` · CVSS 7.5 High · Not analysed yet · Published 27 Jan 2022 · Tags: Denial of service
- [Cookie Prefix Spoofing in CGI::Cookie.parse](https://agentprime.io/advisories/GHSA-4vf4-qmvg-mh7h.md)
  `GHSA-4vf4-qmvg-mh7h`, `BIT-ruby-2021-41819`, `BIT-ruby-min-2021-41819`, `CVE-2021-41819` · RubyGems `cgi`: affected `<0.1.0.1 || >=0.2.0, <0.2.1 || >=0.3.0, <0.3.1`, fixed in `0.1.0.1`, `0.2.1`, `0.3.1` · CVSS 7.5 High · Not analysed yet · Published 21 Jan 2022 · Tags: CWE-565
- [A potential Denial of Service issue in protobuf-java](https://agentprime.io/advisories/GHSA-wrvw-hg22-4m67.md)
  `GHSA-wrvw-hg22-4m67`, `CVE-2021-22569` · Maven `com.google.protobuf:protobuf-java` and 2 more: affected `<3.16.1 || >=3.18.0, <3.18.2 || >=3.19.0, <3.19.2`, fixed in `3.16.1`, `3.18.2`, `3.19.2` · CVSS 7.5 High · Not analysed yet · Published 7 Jan 2022 · Tags: CWE-696
- [Regular Expression Denial of Service (ReDoS) in lodash](https://agentprime.io/advisories/GHSA-29mw-wpgm-hmr9.md)
  `GHSA-29mw-wpgm-hmr9`, `CVE-2020-28500` · npm `lodash` and 4 more: affected `>=4.0.0, <4.17.21`, fixed in `4.17.21` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jan 2022 · Tags: Denial of service
- [CSRF forgery protection bypass in solidus_frontend](https://agentprime.io/advisories/GHSA-h3fg-h5v3-vf8m.md)
  `GHSA-h3fg-h5v3-vf8m`, `CVE-2021-43846` · RubyGems `solidus_frontend`: affected `<2.11.14 || >=3.0.0, <3.0.5 || >=3.1.0, <3.1.5`, fixed in `2.11.14`, `3.0.5`, `3.1.5` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jan 2022 · Tags: Cross-site request forgery (CSRF)
- [Path traversal when MessageBus::Diagnostics is enabled](https://agentprime.io/advisories/GHSA-xmgj-5fh3-xjmm.md)
  `GHSA-xmgj-5fh3-xjmm`, `CVE-2021-43840` · RubyGems `message_bus`: affected `<3.3.7`, fixed in `3.3.7` · CVSS 4.4 Medium · Not analysed yet · Published 17 Dec 2021 · Tags: Path traversal
- [Buffer overrun in CGI.escape_html](https://agentprime.io/advisories/GHSA-5cqm-crxm-6qpv.md)
  `GHSA-5cqm-crxm-6qpv`, `CVE-2021-41816` · RubyGems `cgi`: affected `<0.1.0.1 || >=0.2.0, <0.2.1 || >=0.3.0, <0.3.1`, fixed in `0.1.0.1`, `0.2.1`, `0.3.1` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2021 · Tags: Memory corruption
- [actionpack Open Redirect in Host Authorization Middleware](https://agentprime.io/advisories/GHSA-qphc-hf5q-v8fc.md)
  `GHSA-qphc-hf5q-v8fc`, `BIT-rails-2021-44528`, `CVE-2021-44528` · RubyGems `actionpack`: affected `>=6.0.0, <6.0.4.2 || >=6.1.0, <6.1.4.2`, fixed in `6.0.4.2`, `6.1.4.2` · CVSS 6.1 Medium · Not analysed yet · Published 14 Dec 2021 · Tags: Open redirect
- [Improper Privilege Management in devise_masquerade](https://agentprime.io/advisories/GHSA-25f5-gc4h-hc22.md)
  `GHSA-25f5-gc4h-hc22`, `CVE-2021-28680` · RubyGems `devise_masquerade`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 8.1 High · Not analysed yet · Published 8 Dec 2021 · Tags: Privilege escalation
- [Local Code Execution through Argument Injection via dash leading git url parameter in Gemfile.](https://agentprime.io/advisories/GHSA-fj7f-vq84-fh43.md)
  `GHSA-fj7f-vq84-fh43`, `CVE-2021-43809` · RubyGems `bundler`: affected `<2.2.33`, fixed in `2.2.33` · CVSS 6.7 Medium · Not analysed yet · Published 8 Dec 2021 · Tags: Command injection
- [ReDos vulnerability on guest checkout email validation](https://agentprime.io/advisories/GHSA-qxmr-qxh6-2cc9.md)
  `GHSA-qxmr-qxh6-2cc9`, `CVE-2021-43805` · RubyGems `solidus_core`: affected `<2.11.13 || >=3.0.0, <3.0.4 || >=3.1.0, <3.1.4`, fixed in `2.11.13`, `3.0.4`, `3.1.4` · CVSS 7.5 High · Not analysed yet · Published 7 Dec 2021 · Tags: Denial of service
- [Silent Configuration Failure in Puppet Agent](https://agentprime.io/advisories/GHSA-q4g7-jrxv-67r9.md)
  `GHSA-q4g7-jrxv-67r9`, `CVE-2021-27025` · RubyGems `puppet`: affected `<6.25.1 || >=7.0.0, <7.12.1`, fixed in `6.25.1`, `7.12.1` · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2021
- [Unsafe HTTP Redirect in Puppet Agent and Puppet Server](https://agentprime.io/advisories/GHSA-93j5-g845-9wqp.md)
  `GHSA-93j5-g845-9wqp`, `CVE-2021-27023` · RubyGems `puppet`: affected `<6.25.1 || >=7.0.0, <7.12.1`, fixed in `6.25.1`, `7.12.1` · CVSS 6.5 Medium · Not analysed yet · Published 2 Dec 2021
- [Duplicate Advisory: Authentication Bypass by CSRF Weakness](https://agentprime.io/advisories/GHSA-gpqc-4pp7-5954.md)
  `GHSA-gpqc-4pp7-5954` · RubyGems `spree_auth_devise`: affected `<4.0.1`, fixed in `4.0.1` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF)
- [Duplicate Advisory: Authentication Bypass by CSRF Weakness](https://agentprime.io/advisories/GHSA-8xfw-5q82-3652.md)
  `GHSA-8xfw-5q82-3652` · RubyGems `spree_auth_devise`: affected `>=4.1.0, <4.1.1`, fixed in `4.1.1` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF)
- [Duplicate Advisory: Authentication Bypass by CSRF Weakness](https://agentprime.io/advisories/GHSA-6mqr-q86q-6gwr.md)
  `GHSA-6mqr-q86q-6gwr` · RubyGems `spree_auth_devise`: affected `>=4.2.0, <4.2.1`, fixed in `4.2.1` · CVSS 9.3 Critical · Withdrawn · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF)
- [Spree Auth Devise vulnerability allows for authentication bypass through CSRF weakness](https://agentprime.io/advisories/GHSA-26xx-m4q2-xhq8.md)
  `GHSA-26xx-m4q2-xhq8`, `CVE-2021-41275` · RubyGems `spree_auth_devise`: affected `<4.0.1 || >=4.1.0, <4.1.1 || >=4.2.0, <4.2.1 || >=4.3.0, <4.4.1`, fixed in `4.0.1`, `4.1.1`, `4.2.1`, `4.4.1` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF)
- [Authentication Bypass by CSRF Weakness](https://agentprime.io/advisories/GHSA-5629-8855-gf4g.md)
  `GHSA-5629-8855-gf4g` · RubyGems `solidus_core`: affected `<2.11.12 || >=3.0.0, <3.0.3 || >=3.1.0, <3.1.3`, fixed in `2.11.12`, `3.0.3`, `3.1.3` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF), CWE-305
- [Authentication Bypass by CSRF Weakness](https://agentprime.io/advisories/GHSA-xm34-v85h-9pg2.md)
  `GHSA-xm34-v85h-9pg2`, `CVE-2021-41274` · RubyGems `solidus_auth_devise`: affected `>=1.0.0, <2.5.4`, fixed in `2.5.4` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Nov 2021 · Tags: Cross-site request forgery (CSRF)
- [Regular expression denial of service vulnerability (ReDoS) in date](https://agentprime.io/advisories/GHSA-qg54-694p-wgpp.md)
  `GHSA-qg54-694p-wgpp`, `BIT-ruby-2021-41817`, `BIT-ruby-min-2021-41817`, `CVE-2021-41817` · RubyGems `date`: affected `<2.0.1 || >=3.0.0, <3.0.2 || >=3.1.0, <3.1.2 || >=3.2.0, <3.2.1`, fixed in `2.0.1`, `3.0.2`, `3.1.2`, `3.2.1` · CVSS 7.5 High · Not analysed yet · Published 16 Nov 2021 · Tags: Denial of service
- [Rails Multisite secure/signed cookies share secrets between sites in a multi-site application](https://agentprime.io/advisories/GHSA-844m-cpr9-jcmh.md)
  `GHSA-844m-cpr9-jcmh`, `CVE-2021-41263` · RubyGems `rails_multisite`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 8.3 High · Not analysed yet · Published 15 Nov 2021 · Tags: Information disclosure, Weak cryptography or TLS, CWE-565
- [Publify \`guest\` role users can self-register even when the admin does not allow it](https://agentprime.io/advisories/GHSA-x24j-87x9-jvv5.md)
  `GHSA-x24j-87x9-jvv5`, `BIT-publify-2021-25973`, `CVE-2021-25973` · RubyGems `publify_core`: affected `>=9.0.0.pre1, <9.2.5`, fixed in `9.2.5` · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2021 · Tags: Broken access control, CWE-669
- [ReDoS vulnerability in parser_apache2](https://agentprime.io/advisories/GHSA-hwhf-64mh-r662.md)
  `GHSA-hwhf-64mh-r662`, `BIT-fluentd-2021-41186`, `CVE-2021-41186` · RubyGems `fluentd`: affected `>=0.14.14, <1.14.2`, fixed in `1.14.2` · CVSS 5.9 Medium · Not analysed yet · Published 1 Nov 2021 · Tags: Denial of service
- [XSS in \`\*Text\` options of the Datepicker widget in jquery-ui](https://agentprime.io/advisories/GHSA-j7qv-pgf6-hvh4.md)
  `GHSA-j7qv-pgf6-hvh4`, `BIT-drupal-2021-41183`, `CVE-2021-41183` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.13.0`, fixed in `1.13.0` · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2021 · Tags: Cross-site scripting (XSS)
- [XSS in the \`of\` option of the \`.position()\` util in jquery-ui](https://agentprime.io/advisories/GHSA-gpqq-952q-5327.md)
  `GHSA-gpqq-952q-5327`, `BIT-drupal-2021-41184`, `CVE-2021-41184` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.13.0`, fixed in `1.13.0` · CVSS 6.5 Medium · EPSS 0.41 · Not analysed yet · Published 26 Oct 2021 · Tags: Cross-site scripting (XSS)
- [XSS in the \`altField\` option of the Datepicker widget in jquery-ui](https://agentprime.io/advisories/GHSA-9gj3-hwp5-pmwc.md)
  `GHSA-9gj3-hwp5-pmwc`, `BIT-drupal-2021-41182`, `CVE-2021-41182` · Maven `org.webjars.npm:jquery-ui` and 3 more: affected `<1.13.0`, fixed in `1.13.0` · CVSS 6.5 Medium · EPSS 0.39 · Not analysed yet · Published 26 Oct 2021 · Tags: Cross-site scripting (XSS)
- [OS Command Injection in ftpd](https://agentprime.io/advisories/GHSA-7vxr-6cxg-j3x8.md)
  `GHSA-7vxr-6cxg-j3x8`, `CVE-2013-2512` · RubyGems `ftpd`: affected `<0.2.2`, fixed in `0.2.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2021 · Tags: Command injection
- [Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling](https://agentprime.io/advisories/GHSA-48w2-rm65-62xx.md)
  `GHSA-48w2-rm65-62xx`, `CVE-2021-41136` · RubyGems `puma`: affected `<4.3.9 || >=5.0.0, <5.5.1`, fixed in `4.3.9`, `5.5.1` · CVSS 3.7 Low · Not analysed yet · Published 12 Oct 2021 · Tags: HTTP request smuggling
- [Remote code execution in ruby-jss](https://agentprime.io/advisories/GHSA-vmfh-c547-v45h.md)
  `GHSA-vmfh-c547-v45h`, `CVE-2021-33575` · RubyGems `ruby-jss`: affected `<1.6.0`, fixed in `1.6.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2021
- [Cross-site Scripting in Sidekiq](https://agentprime.io/advisories/GHSA-grh7-935j-hg6w.md)
  `GHSA-grh7-935j-hg6w`, `CVE-2021-30151` · RubyGems `sidekiq`: affected `<5.2.0 || >=6.0.0, <6.2.1`, fixed in `5.2.0`, `6.2.1` · CVSS 6.1 Medium · Not analysed yet · Published 6 Oct 2021 · Tags: Cross-site scripting (XSS)
- [Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby](https://agentprime.io/advisories/GHSA-2rr5-8q37-2w7h.md)
  `GHSA-2rr5-8q37-2w7h`, `CVE-2021-41098` · RubyGems `nokogiri`: affected `<1.12.5`, fixed in `1.12.5` · CVSS 7.5 High · Not analysed yet · Published 27 Sept 2021 · Tags: XML external entities (XXE)
- [Clearance Gem Open Redirect Vulnerability](https://agentprime.io/advisories/GHSA-4hpq-rjcx-7vj9.md)
  `GHSA-4hpq-rjcx-7vj9`, `CVE-2021-23435`, `SNYK-RUBY-CLEARANCE-1577284` · RubyGems `clearance`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 7.6 High · Not analysed yet · Published 13 Sept 2021 · Tags: Open redirect
- [Older releases of better_errors open to Cross-Site Request Forgery attack](https://agentprime.io/advisories/GHSA-w3j4-76qw-wwjm.md)
  `GHSA-w3j4-76qw-wwjm`, `CVE-2021-39197` · RubyGems `better_errors`: affected `<2.8.0`, fixed in `2.8.0` · CVSS 6.3 Medium · Not analysed yet · Published 7 Sept 2021 · Tags: Cross-site request forgery (CSRF)
- [Arbitrary Code Execution in Rdoc](https://agentprime.io/advisories/GHSA-ggxm-pgc9-g7fp.md)
  `GHSA-ggxm-pgc9-g7fp`, `CVE-2021-31799` · RubyGems `rdoc`: affected `>=3.11, <6.1.2.1 || >=6.2.0, <6.2.1.1 || >=6.3.0, <6.3.1`, fixed in `6.1.2.1`, `6.2.1.1`, `6.3.1` · CVSS 7.0 High · Not analysed yet · Published 1 Sept 2021 · Tags: Other injection, Command injection

Newest: <https://agentprime.io/advisories/ecosystem/rubygems.md>
Older: <https://agentprime.io/advisories/ecosystem/rubygems.md?cursor=WyIyMDIxLTA5LTAxVDE4OjUzOjE1LjAwMDAwMFoiLCJHSFNBLWdneG0tcGdjOS1nN2ZwIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?ecosystem=RubyGems&cursor=WyIyMDIyLTA0LTIzVDAwOjQwOjQ1LjAwMDAwMFoiLCJHSFNBLTZ3ajktNzd3cS1qcTdwIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/ecosystem/rubygems/?cursor=WyIyMDIyLTA0LTIzVDAwOjQwOjQ1LjAwMDAwMFoiLCJHSFNBLTZ3ajktNzd3cS1qcTdwIl0>. Everything for agents: <https://agentprime.io/llms.txt>.