agentprime Advisories: RubyGems

Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

Thu, 29 Oct 2026 16:39:49 GMT

shopify_app >=22.1.0, <23.0.3, fixed in 23.0.3. CVSS 7.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crass: Non-ASCII characters cause superlinear CPU consumption

Thu, 29 Oct 2026 16:35:29 GMT

crass <1.0.7, fixed in 1.0.7. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crass: A large number of adjacent CSS comments can trigger a SystemStackError

Thu, 29 Oct 2026 16:35:23 GMT

crass <1.0.7, fixed in 1.0.7. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage

Thu, 29 Oct 2026 16:35:16 GMT

crass <1.0.7, fixed in 1.0.7. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass

Wed, 28 Oct 2026 22:42:53 GMT

crass <1.0.8, fixed in 1.0.8. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Crass : Large numeric exponents cause CPU and memory denial of service

Tue, 20 Oct 2026 14:32:39 GMT

crass <1.0.7, fixed in 1.0.7. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mechanize sends credential headers to another origin after a meta refresh

Thu, 08 Oct 2026 22:09:03 GMT

mechanize <2.14.1, fixed in 2.14.1. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mechanize sends credential headers to another host after an HTTP redirect

Thu, 08 Oct 2026 22:09:00 GMT

mechanize <2.14.1, fixed in 2.14.1. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array

Fri, 02 Oct 2026 23:11:51 GMT

sqlite3 >=1.4.0, <2.9.6, fixed in 2.9.6. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

Wed, 23 Sep 2026 18:57:24 GMT

openc3 >=5.1.0, <7.3.0, fixed in 7.3.0. CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting

Wed, 23 Sep 2026 18:51:01 GMT

openc3 >=5.12.0, <7.3.0, fixed in 7.3.0. CVSS 8.8 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Tue, 22 Sep 2026 20:40:30 GMT

spree_api >=5.4.0, <5.4.4 || >=5.5.0, <5.5.4, fixed in 5.4.4, 5.5.4. CVSS 7.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers

Tue, 22 Sep 2026 20:34:27 GMT

net.sf.mpxj:mpxj >=7.3.0, <16.5.0, fixed in 16.5.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MPXJ: XXE Vulnerability in MerlinReader

Tue, 22 Sep 2026 20:34:25 GMT

net.sf.mpxj:mpxj >=5.5.5, <16.4.1, fixed in 16.4.1. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

decidim-elections: Election question titles allow stored script execution

Wed, 09 Sep 2026 17:59:52 GMT

decidim-elections <0.32.0, fixed in 0.32.0. CVSS 4.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

rubyzip path traversal vulnerability

Thu, 03 Sep 2026 21:31:16 GMT

rubyzip <3.4.0, fixed in 3.4.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Mail: Email address spoofing via malformed RFC 2047 encoded-words

Wed, 02 Sep 2026 22:02:32 GMT

mail <2.9.1, fixed in 2.9.1. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Nokogiri does not check the return value from xmlC14NExecute

Tue, 25 Aug 2026 18:31:53 GMT

nokogiri >=1.5.1, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Nokogiri XSLT transform has a memory leak

Tue, 25 Aug 2026 18:31:52 GMT

nokogiri *, no fixed version yet. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Duplicate Advisory: Nokogiri CSS selector tokenizer has regular expression backtracking

Tue, 25 Aug 2026 18:31:52 GMT

nokogiri *, no fixed version yet. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)

Tue, 18 Aug 2026 20:09:59 GMT

kobako >=0.1.0, <0.9.1, fixed in 0.9.1. CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Fri, 07 Aug 2026 18:33:12 GMT

json >=2.20.0, <2.21.2, fixed in 2.21.2. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

guard-livereload has a directory traversal vulnerability

Fri, 31 Jul 2026 22:33:01 GMT

guard-livereload <2.5.2, fixed in 2.5.2. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Savon::Model evaluates WSDL operation names as Ruby source

Fri, 31 Jul 2026 19:38:25 GMT

savon >=0.9.8, <2.17.2, fixed in 2.17.2. CVSS 8.1 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Thu, 30 Jul 2026 18:23:33 GMT

activestorage <7.2.3.2 || >=8.0.0.beta1, <8.0.5.1 || >=8.1.0.beta1, <8.1.3.1, fixed in 7.2.3.2, 8.0.5.1, 8.1.3.1. CVSS 9.5 (Critical). Critical: CVSS score 9.5: 9.0 or more. CVSS score 9.5 (7.0 or more) and EPSS 0.30 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Thu, 30 Jul 2026 16:33:12 GMT

msgpack <1.8.2, fixed in 1.8.2. CVSS 2.1 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Ruby SSE Session Poisoning

Thu, 30 Jul 2026 14:44:28 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 8.3 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Thu, 30 Jul 2026 14:44:06 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Thu, 30 Jul 2026 14:43:29 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 5.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

Thu, 30 Jul 2026 14:41:58 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 6.2 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

Thu, 30 Jul 2026 14:41:39 GMT

mcp <0.23.0, fixed in 0.23.0. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal

Wed, 29 Jul 2026 17:06:00 GMT

activerecord-tenanted <0.7.0, fixed in 0.7.0. Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Pagy I18n locale option is not validated before being used in a file path

Tue, 28 Jul 2026 22:25:29 GMT

pagy >=43.0.0, <43.5.6, fixed in 43.5.6. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

Tue, 28 Jul 2026 16:32:45 GMT

oauth2 >=0.4.0, <2.0.22, fixed in 2.0.22. CVSS 8.6 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

OAuth: Cross-origin token-request redirects can expose signed request metadata

Tue, 28 Jul 2026 16:27:11 GMT

oauth >=0.5.5, <1.1.6, fixed in 1.1.6. CVSS 7.2 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks

Tue, 28 Jul 2026 16:23:57 GMT

sqlite3 >=2.1.0, <2.9.5, fixed in 2.9.5. CVSS 2.0 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity

Tue, 28 Jul 2026 16:21:31 GMT

sqlite3 <2.9.5, fixed in 2.9.5. CVSS 2.0 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Trix: Stored XSS via HTMLParser attribute injection on paste

Fri, 24 Jul 2026 16:18:01 GMT

trix <2.1.18, fixed in 2.1.18. CVSS 4.6 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Ruby json: JSON generator heap buffer overflow when streaming to an IO

Thu, 23 Jul 2026 19:48:08 GMT

json >=2.9.0, <2.19.9, fixed in 2.19.9. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Tue, 21 Jul 2026 22:05:28 GMT

rails-html-sanitizer >=1.0.3, <1.7.1, fixed in 1.7.1. CVSS 5.1 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

Tue, 21 Jul 2026 22:03:11 GMT

loofah >=2.25.0, <2.25.2, fixed in 2.25.2. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Loofah: SVG `href` attribute bypasses local-reference restriction

Tue, 21 Jul 2026 22:01:58 GMT

loofah <2.25.2, fixed in 2.25.2. CVSS 4.7 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

websocket-driver-ruby: Denial of service via malformed Host header

Tue, 21 Jul 2026 18:34:42 GMT

websocket-driver <0.8.2, fixed in 0.8.2. CVSS 8.9 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Tue, 21 Jul 2026 15:04:14 GMT

loofah >=2.25.0, <2.25.2, fixed in 2.25.2. CVSS 2.3 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 23:07:49 GMT

datadog <2.32.0, fixed in 2.32.0. CVSS 7.5 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

ViewComponent: Reused Component Instances Retain Stale Render Context

Wed, 15 Jul 2026 22:51:33 GMT

view_component >=4.0.0, <4.12.0, fixed in 4.12.0. CVSS 6.8 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

ViewComponent: around_render HTML-Safety Bypass

Wed, 15 Jul 2026 22:51:04 GMT

view_component >=4.0.0, <4.12.0, fixed in 4.12.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

websocket-driver: Memory exhaustion in HTTP header parser

Wed, 15 Jul 2026 22:05:39 GMT

websocket-driver <0.8.1, fixed in 0.8.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

websocket-driver: Resource limit bypass via message compression

Wed, 15 Jul 2026 22:03:59 GMT

websocket-driver <0.8.1, fixed in 0.8.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.

websocket-driver: Memory exhaustion via abuse of protocol length headers

Wed, 15 Jul 2026 22:01:52 GMT

websocket-driver <0.8.1, fixed in 0.8.1. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.