RubyGems Advisories.

Rack has a Directory Traversal via Rack:Directory

• Path traversal
• CWE-548

<2.2.22 || >=3.0.0.beta1, <3.1.20 || >=3.2.0, <3.2.5 · fixed in 2.2.22, 3.1.20, 3.2.5

Bitcoinrb Vulnerable to Command injection via RPC

• Command injection

<1.12.0 · fixed in 1.12.0

Faraday affected by SSRF via protocol-relative URL host override in build_exclusive_url

• Server-side request forgery (SSRF)

>=1.0.0, <1.10.5 || >=2.0.0, <2.14.1 · fixed in 1.10.5, 2.14.1

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

• Cross-site scripting (XSS)

<1.11.1 || >=2.0.0.beta1, <2.0.2 || >=2.1.0, <2.1.3 || >=2.2.0, <2.2.2 || >=2.3.0, <2.3.2 || >=2.4.0.beta1, <2.4.1 · fixed in 1.11.1, 2.0.2, 2.1.3, 2.2.2, 2.3.2, 2.4.1

Unauthenticated Spree Commerce users can access all guest addresses

• Broken access control

<4.10.3 || >=5.0.0, <5.0.8 || >=5.1.0, <5.1.10 || >=5.2.0, <5.2.7 || >=5.3.0, <5.3.2 · fixed in 4.10.3, 5.0.8, 5.1.10, 5.2.7, 5.3.2

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

• Broken access control

<5.0.8 || >=5.1.0, <5.1.10 || >=5.2.0, <5.2.7 || >=5.3.0, <5.3.2 · fixed in 5.0.8, 5.1.10, 5.2.7, 5.3.2

Decidim's private data exports can lead to data leaks

• Information disclosure
• CWE-703

>=0.30.0, <0.30.4 · fixed in 0.30.4

fog-kubevirt allows remote attacker to perform MITM attack due to disabled certificate validation

• Weak cryptography or TLS

<1.5.1 · fixed in 1.5.1

foreman_kubevirt disables SSL verification if a Certificate Authority (CA) certificate is not explicitly set

• Weak cryptography or TLS

<0.4.3 · fixed in 0.4.3

Cassandra Web - Remote File Read

• Path traversal

<=0.5.0 · no fixed version yet

AlchemyCMS: Authenticated Remote Code Execution (RCE) via eval injection in ResourcesHelper

• Code injection

<7.4.12 || >=8.0.0.a, <8.0.3 · fixed in 7.4.12, 8.0.3

Active Job - Object injection security vulnerability

• Other injection

<4.2.0.beta2 · fixed in 4.2.0.beta2

ActiveRecord-JDBC-Adapter (AR-JDBC) lib/arjdbc/jdbc/adapter.rb sql.gsub() Function SQL Injection

• SQL injection

<1.2.8 · fixed in 1.2.8

openc3-api Vulnerable to Unauthenticated Remote Code Execution

• Code injection

>=5.0.6, <6.10.2 · fixed in 6.10.2

Spree API has Unauthenticated IDOR - Guest Address

• Broken access control

>=4.0.0, <4.10.2 || >=5.0.0, <5.0.7 || >=5.1.0, <5.1.9 || >=5.2.0, <5.2.5 · fixed in 4.10.2, 5.0.7, 5.1.9, 5.2.5

Spree API has Authenticated Insecure Direct Object Reference (IDOR) via Order Modification

• Broken access control

>=3.7.0, <4.10.2 || >=5.0.0, <5.0.7 || >=5.1.0, <5.1.9 || >=5.2.0, <5.2.5 · fixed in 4.10.2, 5.0.7, 5.1.9, 5.2.5

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

• Information disclosure

<9.5.0 · fixed in 9.5.0

Trix has a stored XSS vulnerability through its attachment attribute

• Cross-site scripting (XSS)

<2.1.16 · fixed in 2.1.16

URI Credential Leakage Bypass over CVE-2025-27221

• Information disclosure
• CWE-212

<0.12.5 || >=0.13.0, <0.13.3 || >=1.0.0, <1.0.4 · fixed in 0.12.5, 0.13.3, 1.0.4

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

• Server-side request forgery (SSRF)

<0.24.0 · fixed in 0.24.0

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

• Weak cryptography or TLS

<1.208.0 · fixed in 1.208.0

ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay

• Weak cryptography or TLS
• CWE-115

<1.0.0 · fixed in 1.0.0

Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation

• Weak cryptography or TLS

<1.18.0 · fixed in 1.18.0

Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

• Weak cryptography or TLS

<1.18.0 · fixed in 1.18.0

Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

• Cross-site scripting (XSS)

<0.2.1 · fixed in 0.2.1

Duplicate Advisory: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

• Cross-site scripting (XSS)

<0.2.1 · fixed in 0.2.1

MQTT does not validate hostnames

• CWE-29

<0.7.0 · fixed in 0.7.0

Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values

• Cross-site scripting (XSS)

<0.2.1 · fixed in 0.2.1

Sinatra is vulnerable to ReDoS through ETag header value generation

• Denial of service

<4.2.0 · fixed in 4.2.0

Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing

• Denial of service

<2.2.20 || >=3.0, <3.1.18 || >=3.2, <3.2.3 · fixed in 2.2.20, 3.1.18, 3.2.3

Rack has a Possible Information Disclosure Vulnerability

• Information disclosure
• CWE-441

<2.2.20 || >=3.0, <3.1.18 || >=3.2, <3.2.3 · fixed in 2.2.20, 3.1.18, 3.2.3

Rack's multipart parser buffers unbounded per-part headers, enabling DoS (memory exhaustion)

• Denial of service

<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2 · fixed in 2.2.19, 3.1.17, 3.2.2

Rack: Multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)

• Denial of service

<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2 · fixed in 2.2.19, 3.1.17, 3.2.2

Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)

• Denial of service

<2.2.19 || >=3.1, <3.1.17 || >=3.2, <3.2.2 · fixed in 2.2.19, 3.1.17, 3.2.2

Rack has an unsafe default in Rack::QueryParser allows params_limit bypass via semicolon-separated parameters

• Denial of service

<2.2.18 · fixed in 2.2.18

REXML has DoS condition when parsing malformed XML file

• Denial of service

>=3.3.3, <3.4.2 · fixed in 3.4.2

Google Sign-In for Rails allowed redirect to protocol-relative URI

• Open redirect

<1.3.1 · fixed in 1.3.1

Google Sign-In for Rails allowed redirects to malformed URLs

• Open redirect

<1.3.0 · fixed in 1.3.0

Spree Commerce is vulnerable to RCE through Search API

• Command injection
• Code injection

<=3.0.1 · no fixed version yet

Active Storage allowed transformation methods that were potentially unsafe

• Command injection
• Code injection

>=5.2.0, <7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1 · fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1

Active Record logging vulnerable to ANSI escape injection

• CWE-150

<7.1.5.2 || >=7.2, <7.2.2.2 || >=8.0, <8.0.2.1 · fixed in 7.1.5.2, 7.2.2.2, 8.0.2.1

Spree has Remote Command Execution vulnerability in search functionality

• Code injection
• Prototype pollution

<0.60.2 · fixed in 0.60.2

JWE is missing AES-GCM authentication tag validation in encrypted JWE

• CWE-354

<1.1.1 · fixed in 1.1.1

Ruby SAML DOS vulnerability with large SAML response

• Denial of service

<1.18.1 · fixed in 1.18.1

Nokogiri patches vendored libxml2 to resolve multiple CVEs

<1.18.9 · fixed in 1.18.9

Withdrawn Advisory: Thor can construct an unsafe shell command from library input.

• Command injection

<1.4.0 · fixed in 1.4.0

Measured is vulnerable to Path Traversal attacks during class initialization

• Path traversal

<3.2.1 · fixed in 3.2.1

resolv vulnerable to DoS via insufficient DNS domain name length validation

• Denial of service
• CWE-1284

<0.2.3 || >=0.3.0, <0.3.1 || >=0.4.0, <0.6.2 · fixed in 0.2.3, 0.3.1, 0.6.2

Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

• Command injection

<1.11 · fixed in 1.11

HashiCorp Vagrant has code injection vulnerability through default synced folders

• Code injection
• Broken access control

>=2.2.10, <2.4.7 · fixed in 2.4.7

Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling

• HTTP request smuggling

<1.8.2 · fixed in 1.8.2

sparklemotion nokogiri hashmap.c hashmap_get_with_hash heap-based overflow

• Memory corruption

=0 · no fixed version yet

sparklemotion nokogiri hashmap.c hashmap_set_with_hash heap-based overflow

• Memory corruption

=0 · no fixed version yet

ReDoS Vulnerability in Rack::Multipart handle_mime_head

• Denial of service

>=3.1.0, <3.1.16 · fixed in 3.1.16

Rack has an Unbounded-Parameter DoS in Rack::QueryParser

• Denial of service

<2.2.14 || >=3.0, <3.0.16 || >=3.1, <3.1.14 · fixed in 2.2.14, 3.0.16, 3.1.14

Rack session gets restored after deletion

• Race condition
• Authentication bypass

>=2.0.0, <2.1.1 · fixed in 2.1.1

Rack session gets restored after deletion

• Race condition
• Authentication bypass

<2.2.14 · fixed in 2.2.14

JRuby-OpenSSL has hostname verification disabled by default

• Weak cryptography or TLS

>=10.0.0.0, <10.0.0.1 || >=9.3.4.0, <9.4.12.1 · fixed in 10.0.0.1, 9.4.12.1

net-imap rubygem vulnerable to possible DoS by memory exhaustion

• Denial of service
• CWE-405

<0.2.5 || >=0.3.0, <0.3.9 || >=0.4.0, <0.4.20 || >=0.5.0, <0.5.7 · fixed in 0.2.5, 0.3.9, 0.4.20, 0.5.7

Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

• CWE-1395

<1.18.8 · fixed in 1.18.8