RubyGems Advisories.

net-imap vulnerable to STARTTLS stripping via invalid response timing

• CWE-325
• CWE-392

<0.3.10 || >=0.4.0, <0.4.24 || >=0.5.0, <0.5.14 || >=0.6.0, <0.6.4 · fixed in 0.3.10, 0.4.24, 0.5.14, 0.6.4

Avo: Broken Access Control Through Unauthorized Execution of Arbitrary Action Classes Across Resources

• Broken access control

<3.31.2 · fixed in 3.31.2

ERB has an @_init deserialization guard bypass via def_module / def_method / def_class

• Insecure deserialization
• CWE-693

<4.0.3.1 || >=4.0.4, <4.0.4.1 || >=5.0.0, <6.0.1.1 || >=6.0.2, <6.0.4 · fixed in 4.0.3.1, 4.0.4.1, 6.0.1.1, 6.0.4

OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool

• Privilege escalation

<7.0.0-rc3 · fixed in 7.0.0-rc3

OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database

• SQL injection

>=6.7.0, <7.0.0-rc3 · fixed in 7.0.0-rc3

OpenC3 COSMOS is Vulnerable to Self-XSS Through the Command Sender

• Cross-site scripting (XSS)

<7.0.0 · fixed in 7.0.0

OpenC3 COSMOS allows arbitrary writes to plugins directory via path-traversed config filenames

• Path traversal

<6.10.5 || >=7.0.0.pre.rc1, <7.0.0-rc3 · fixed in 6.10.5, 7.0.0-rc3

OpenC3 COSMOS: Hijacked session token can be used to reset password for persistence

• CWE-620

<6.10.5 || >=7.0.0.pre.rc1, <7.0.0-rc3 · fixed in 6.10.5, 7.0.0-rc3

yard: Possible arbitrary path traversal and file access via yard server

• Path traversal

<0.9.42 · fixed in 0.9.42

Buffer Overflow in Zlib::GzipReader ungetc via large input leads to memory corruption

• Memory corruption

<3.0.1 || >=3.1.0, <3.1.2 || >=3.2.0, <3.2.3 · fixed in 3.0.1, 3.1.2, 3.2.3

Uncontrolled resource consumption and loop with unreachable exit condition in facil.io and downstream iodine ruby gem

• Denial of service

<=0.7.58 · no fixed version yet

Decidim amendments can be accepted or rejected by anyone

• Privilege escalation

>=0.19.0, <0.30.5 || >=0.31.0.rc1, <0.31.1 · fixed in 0.30.5, 0.31.1

Fat Free CRM has BOLA in DELETE /emails/:id - Any authenticated user can hit this endpoint and delete emails by ID

• Broken access control

<0.26.0 · fixed in 0.26.0

Decidim has a cross-site scripting (XSS) in user name

• Cross-site scripting (XSS)

<0.30.5 || >=0.31.0.rc1, <0.31.1 · fixed in 0.30.5, 0.31.1

bsv-sdk ARC broadcaster treats INVALID/MALFORMED/ORPHAN responses as successful broadcasts

• CWE-754

>=0.1.0, <0.8.2 · fixed in 0.8.2

bsv-sdk and bsv-wallet persist unverified certifier signatures in acquire_certificate (direct and issuance paths)

• Weak cryptography or TLS

>=0.3.1, <0.8.2 · fixed in 0.8.2

Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

• Authentication bypass
• Insecure deserialization

>=2.0.0, <2.1.2 · fixed in 2.1.2

Addressable has a Regular Expression Denial of Service in Addressable templates

• Denial of service

>=2.3.0, <2.9.0 · fixed in 2.9.0

rdiscount has an Out-of-bounds Read

• Memory corruption

>=1.3.1.1, <2.2.7.4 · fixed in 2.2.7.4

Rack::Request accepts invalid Host characters, enabling host allowlist bypass

• CWE-1286

>=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 3.1.21, 3.2.6

Rack has Content-Length mismatch in Rack::Files error responses

• CWE-130
• CWE-135

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack::Sendfile header-based X-Accel-Mapping regex injection enables unauthorized X-Accel-Redirect

• CWE-625

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack's multipart parsing without Content-Length header allows unbounded chunked file uploads

• Denial of service

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack has a root directory disclosure via unescaped regex interpolation in Rack::Directory

• CWE-625

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

• Denial of service

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack: Forwarded Header semicolon injection enables Host and Scheme spoofing

• CWE-436

>=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 3.1.21, 3.2.6

Rack's improper unfolding of folded multipart headers preserves CRLF in parsed parameter values

• Other injection

>=3.2.0, <3.2.6 · fixed in 3.2.6

Rack's greedy multipart boundary parsing can cause parser differentials and WAF bypass.

• CWE-436

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack's multipart header parsing allows Denial of Service via escape-heavy quoted parameters

• Denial of service

>=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 3.1.21, 3.2.6

Rack's multipart byte range processing allows denial of service via excessive overlapping ranges

• Denial of service

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack:: Static header_rules bypass via URL-encoded paths

• CWE-180

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Rack::Static prefix matching can expose unintended files under the static root

• Information disclosure
• CWE-187

<2.2.23 || >=3.0.0.beta1, <3.1.21 || >=3.2.0, <3.2.6 · fixed in 2.2.23, 3.1.21, 3.2.6

Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)

• Cross-site scripting (XSS)

<2.1.18 · fixed in 2.1.18

Ruby LSP has arbitrary code execution through branch setting

• Code injection

<0.26.9 · fixed in 0.26.9

MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

• Authentication bypass
• Broken access control

<0.9.2 · fixed in 0.9.2

Loofah has improper detection of disallowed URIs via `allowed_uri?`

• Cross-site scripting (XSS)
• CWE-116

>=2.25.0, <2.25.1 · fixed in 2.25.1

Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests

• Denial of service

<7.2.3.1 || >=8.0.0, <8.0.4.1 || >=8.1.0, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

iCalendar has ICS injection via unsanitized URI property values

• Other injection

>=2.0.0, <2.12.2 · fixed in 2.12.2

Rails Active Storage has possible glob injection in its DiskService

• Other injection

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Storage has possible Path Traversal in DiskService

• Path traversal

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Support has a possible DoS vulnerability in its number helpers

• Denial of service

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

• Denial of service

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Storage has possible content type bypass via metadata in direct uploads

• CWE-925

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

• Cross-site scripting (XSS)

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

• Denial of service

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails has a possible XSS vulnerability in its Action View tag helpers

• Cross-site scripting (XSS)

<7.2.3.1 || >=8.0.0.beta1, <8.0.4.1 || >=8.1.0.beta1, <8.1.2.1 · fixed in 7.2.3.1, 8.0.4.1, 8.1.2.1

Rails has a possible XSS vulnerability in its Action Pack debug exceptions

• Cross-site scripting (XSS)

>=8.1.0, <8.1.2.1 · fixed in 8.1.2.1

Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

• CWE-913

<1.10.2 · fixed in 1.10.2

bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

• Memory corruption

<3.1.22 · fixed in 3.1.22

Ruby JSON has a format string injection vulnerability

• Memory corruption

>=2.14.0, <2.15.2.1 || >=2.16.0, <2.17.1.2 || >=2.18.0, <2.19.2 · fixed in 2.15.2.1, 2.17.1.2, 2.19.2

Avo has a XSS vulnerability on `return_to` param

• Cross-site scripting (XSS)

<3.30.3 · fixed in 3.30.3

Improper detection of disallowed URIs by Loofah `allowed_uri?`

• Cross-site scripting (XSS)

>=2.25.0, <2.25.1 · fixed in 2.25.1

Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

• Race condition

<5.0.3 · fixed in 5.0.3

Katello: Denial of Service and potential information disclosure via SQL injection

• SQL injection

<4.19.1 · fixed in 4.19.1

Trix has a Stored XSS vulnerability through serialized attributes

• Cross-site scripting (XSS)

<2.1.17 · fixed in 2.1.17

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

• CWE-252

<0.2.3 · fixed in 0.2.3

Camaleon CMS vulnerable to Path Traversal through AWS S3 uploader implementation

• Path traversal

>=2.4.5.0, <=2.9.1 · no fixed version yet

rubyipmi is vulnerable to OS Command Injection through malicious usernames

• Command injection

<0.13.0 · fixed in 0.13.0

Nokogiri does not check the return value from xmlC14NExecute

• CWE-252

>=1.5.1, <1.19.1 · fixed in 1.19.1

Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

• Cross-site scripting (XSS)

<2.2.22 || >=3.0.0.beta1, <3.1.20 || >=3.2.0, <3.2.5 · fixed in 2.2.22, 3.1.20, 3.2.5