RubyGems Advisories.

Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

• Cross-site scripting (XSS)

<10.0.2 · fixed in 10.0.2

Pitchfork HTTP Request/Response Splitting vulnerability

• Other injection

<0.11.0 · fixed in 0.11.0

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

• Memory corruption
• CWE-1395

<1.18.4 · fixed in 1.18.4

Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

• Broken access control

<2.9.1 · fixed in 2.9.1

Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

• Weak cryptography or TLS
• CWE-436

<1.12.4 || >=1.13.0, <1.18.0 · fixed in 1.12.4, 1.18.0

Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

• Weak cryptography or TLS
• CWE-436

<1.12.4 || >=1.13.0, <1.18.0 · fixed in 1.12.4, 1.18.0

Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

• Denial of service

<1.12.4 || >=1.13.0, <1.18.0 · fixed in 1.12.4, 1.18.0

omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

• Weak cryptography or TLS

<1.10.6 || >=2.0.0, <2.1.3 || >=2.2.0, <2.2.3 · fixed in 1.10.6, 2.1.3, 2.2.3

graphql allows remote code execution when loading a crafted GraphQL schema

• Code injection

>=1.11.5, <1.11.11 || >=1.12.0, <1.12.25 || >=1.13.0, <1.13.24 || >=2.0.0, <2.0.32 || >=2.1.0, <2.1.15 || >=2.2.0, <2.2.17 || >=2.3.0, <2.3.21 || >=2.4.0, <2.4.13 · fixed in 1.11.11, 1.12.25, 1.13.24, 2.0.32, 2.1.15, 2.2.17, 2.3.21, 2.4.13

Out-of-bounds Read in Ruby JSON Parser

• Memory corruption

>=2.10.0, <2.10.2 · fixed in 2.10.2

Local File Inclusion in Rack::Static

• Path traversal

<2.2.13 || >=3.0, <3.0.14 || >=3.1, <3.1.12 · fixed in 2.2.13, 3.0.14, 3.1.12

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

• Other injection

<2.2.12 || >=3.0, <3.0.13 || >=3.1, <3.1.11 · fixed in 2.2.12, 3.0.13, 3.1.11

URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+

• Information disclosure
• CWE-212

<0.11.3 || >=0.12.0, <0.12.4 || >=0.13.0, <0.13.2 || >=1.0.0, <1.0.3 · fixed in 0.11.3, 0.12.4, 0.13.2, 1.0.3

CGI has Regular Expression Denial of Service (ReDoS) potential in Util#escapeElement

• Denial of service

<0.3.5.1 || >=0.3.6, <0.3.7 || >=0.4.0, <0.4.2 · fixed in 0.3.5.1, 0.3.7, 0.4.2

CGI has Denial of Service (DoS) potential in Cookie.parse

• Denial of service

<0.3.5.1 || >=0.3.6, <0.3.7 || >=0.4.0, <0.4.2 · fixed in 0.3.5.1, 0.3.7, 0.4.2

Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

• Path traversal

<0.15.0 · fixed in 0.15.0

Phusion Passenger denial of service

• Memory corruption

>=6.0.21, <6.0.26 · fixed in 6.0.26

Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

• CWE-1395

<1.18.3 · fixed in 1.18.3

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

• Memory corruption
• CWE-1395

<1.18.3 · fixed in 1.18.3

Possible Log Injection in Rack::CommonLogger

• Other injection

<2.2.11 || >=3.0, <3.0.12 || >=3.1, <3.1.10 · fixed in 2.2.11, 3.0.12, 3.1.10

Possible DoS by memory exhaustion in net-imap

• Denial of service
• CWE-405

>=0.3.2, <0.3.8 || >=0.4.0, <0.4.19 || >=0.5.0, <0.5.6 · fixed in 0.3.8, 0.4.19, 0.5.6

Password Pusher Allows Session Token Interception Leading to Potential Hijacking

• Authentication bypass

<=1.50.3 · no fixed version yet

Possible Content Security Policy bypass in Action Dispatch

• Cross-site scripting (XSS)

>=5.2.0, <7.0.8.7 || >=7.1.0, <7.1.5.1 || >=7.2.0, <7.2.2.1 || >=8.0.0, <8.0.0.1 · fixed in 7.0.8.7, 7.1.5.1, 7.2.2.1, 8.0.0.1

rails-html-sanitizer has XSS vulnerability with certain configurations

• Cross-site scripting (XSS)

>=1.6.0, <1.6.1 · fixed in 1.6.1

rails-html-sanitizer has XSS vulnerability with certain configurations

• Cross-site scripting (XSS)

>=1.6.0, <1.6.1 · fixed in 1.6.1

rails-html-sanitizer has XSS vulnerability with certain configurations

• Cross-site scripting (XSS)

>=1.6.0, <1.6.1 · fixed in 1.6.1

rails-html-sanitizer has XSS vulnerability with certain configurations

• Cross-site scripting (XSS)

>=1.6.0, <1.6.1 · fixed in 1.6.1

rails-html-sanitize has XSS vulnerability with certain configurations

• Cross-site scripting (XSS)

>=1.6.0, <1.6.1 · fixed in 1.6.1

Password Pusher rate limiter can be bypassed by forging proxy headers

• Denial of service

<1.49.0 · fixed in 1.49.0

decidim-meetings Cross-site scripting vulnerability in the online or hybrid meeting embeds

• Cross-site scripting (XSS)

>=0.28.0, <0.28.3 · fixed in 0.28.3

Decidim-Awesome has SQL injection in AdminAccountability

• SQL injection

>=0.9.1, <0.10.3 || >=0.11.0, <0.11.2 · fixed in 0.10.3, 0.11.2

Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

• CWE-807

<4.1.0 · fixed in 4.1.0

MPXJ has a Potential Path Traversal Vulnerability

• Path traversal

>=8.3.5, <13.5.1 · fixed in 13.5.1

REXML ReDoS vulnerability

• Denial of service

<3.3.9 · fixed in 3.3.9

Autolab Misconfigured Reset Password Permissions

• Authentication bypass
• Broken access control

>=3.0.0, <3.0.1 · fixed in 3.0.1

camaleon_cms affected by cross site scripting

• Cross-site scripting (XSS)

<=2.7.5 · no fixed version yet

Possible ReDoS vulnerability in block_format in Action Mailer

• Denial of service

>=3.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1 · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1

Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text

• Denial of service

>=6.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1 · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1

Possible ReDoS vulnerability in HTTP Token authentication in Action Controller

• Denial of service

>=4.0.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1 · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1

Possible ReDoS vulnerability in query parameter filtering in Action Dispatch

• Denial of service

>=3.1.0, <6.1.7.9 || >=7.0.0, <7.0.8.5 || >=7.1.0, <7.1.4.1 || >=7.2.0, <7.2.1.1 · fixed in 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1

OpenC3 stores passwords in clear text (`GHSL-2024-129`)

• Information disclosure
• Hard-coded credentials

<5.19.0 · fixed in 5.19.0

OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)

• Path traversal

<5.19.0 · fixed in 5.19.0

OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)

• Cross-site scripting (XSS)

<5.19.0 · fixed in 5.19.0

Decidim has a cross-site scripting vulnerability in the version control page

• Cross-site scripting (XSS)

<0.27.8 · fixed in 0.27.8

Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

• Cross-site scripting (XSS)

>=2.8.0, <2.8.2 · fixed in 2.8.2

Heap-based Buffer Overflow in sqlite-vec

• Memory corruption

<0.1.3 · fixed in 0.1.3

Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

• Cross-site scripting (XSS)

<2.8.1 · fixed in 2.8.1

Duplicate Advisory: Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

<2.8.1 · fixed in 2.8.1

HTTP Request Smuggling in ruby webrick

• HTTP request smuggling

<1.8.2 · fixed in 1.8.2

Puma's header normalization allows for client to clobber proxy set headers

• HTTP request smuggling
• Broken access control

<5.6.9 || >=6.0.0, <6.4.3 · fixed in 5.6.9, 6.4.3

protobuf-java has potential Denial of Service issue

• Denial of service
• Memory corruption

<3.25.5 || >=4.0.0-RC1, <4.27.5 || >=4.28.0-RC1, <4.28.2 · fixed in 3.25.5, 4.27.5, 4.28.2

Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

• Path traversal

<2.8.1 · fixed in 2.8.1

Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

• Cross-site scripting (XSS)

<2.8.1 · fixed in 2.8.1

Camaleon CMS vulnerable to arbitrary path traversal (GHSL-2024-183)

• Path traversal
• Information disclosure

<2.8.1 · fixed in 2.8.1

Camaleon CMS affected by arbitrary file write to RCE (GHSL-2024-182)

• Path traversal
• Other injection

>=2.8.0, <2.8.1 · fixed in 2.8.1

Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

• CWE-331

>=4.0.0, <6.0.0 · fixed in 6.0.0

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin panel with QuillJS WYSWYG editor

• Cross-site scripting (XSS)

<0.27.7 · fixed in 0.27.7

Decidim::Admin vulnerable to cross-site scripting (XSS) in the admin activity log

• Cross-site scripting (XSS)

<0.27.7 || >=0.28.0, <0.28.2 · fixed in 0.27.7, 0.28.2

omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

• Weak cryptography or TLS

<1.10.5 || >=2.0.0, <2.1.2 || >=2.2.0, <2.2.1 · fixed in 1.10.5, 2.1.2, 2.2.1

SAML authentication bypass via Incorrect XPath selector

• Weak cryptography or TLS

<1.12.3 || >=1.13.0, <1.17.0 · fixed in 1.12.3, 1.17.0