CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.

A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.

flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands.

Awesome spawn prior to version 1.2.0 contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.

The `Zip::File` component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses `../` pathname substrings to write arbitrary files to the filesystem.

The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.

`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

Redis-store prior to 1.4.0 allows unsafe objects to be loaded from redis

Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10 due to an unlimited length user name field.

Camaleon CMS prior to 2.7.4 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the `formats` parameter.

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.

With the consul ruby gem before 1.0.3, if a controller checks multiple powers  using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.

The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field.

A flaw in `db.rb` is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands.

In particular lines 76 and 95 (as of `2014-06-01`) pass unsanitized user supplied input to the command line. 

```
73-      host = "{@configuration["user"]}@{@configuration["host"]}"
74-      cmd  = "ssh #{host} cat {server_db_config_file}"
75-
76:      server_db_config_output = `{cmd}`
79-
--
89- def drop_and_create_local_database(local_db_config)
90-      command = case local_db_config["adapter"]
91-      when "mysql2"
93-      when "postgresql"
95-          dropdb -h #{local_db_config["host"]} -U #{local_db_config["username"]} --if-exists #{local_db_config["database"]}
```

If this gem is used in the context of a rails application malicious input could lead to remote command injection. As of version 2.5.2 the affected code lines have not changed.

### Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.

The following vulnerabilities are addressed by this advisory:

* Incorrect parsing of trailing fields in chunked transfer encoding bodies
* Parsing of blank/zero-length Content-Length headers

### Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.

### Workarounds
No known workarounds.

### References
[HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information
If you have any questions or comments about this advisory:

Open an issue in [Puma](https://github.com/puma/puma)
See our [security policy](https://github.com/puma/puma/security/policy)


### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.

lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.

### Impact

The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.

### Patches

Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).

### Workarounds

The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.

### References

See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.


git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to `cd ` and `git clone ` commands in the library.

### Impact

When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

```rb
ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED
```

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

### Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

### Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

```rb
operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)
```

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

## Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

### Impact
For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

```erb
<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>
```

The string provided in the variable `@user_supplied_string` would be invoked as a method call inside the `@user` object (unless the string contains any of the following: `password`, `time_zone`, `country`, `email`, `phone` and `url`).

By manipulation that input, an attacker could do any of the following:

- Code execution (call actions like `#destroy`)
- Denial of Service (by executing a computation intensive method)
- Information Disclosure (check the presence of methods, leak user information)

### Patches
The problem was fixed in version `5.0`. Although it's a major version, there should be no issues with upgrading for `4.x`. The reason it was released in a major version is that the configuration `SimpleForm.file_methods` was deprecated in order to fix the problem.

### Workarounds
The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected.
A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the `as` option, like the following:
```erb
<%= form.input :avatar, as: :file %>
```

### References
[TDB]

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/plataformatec/simple_form](https://github.com/plataformatec/simple_form)
* Email us at [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)

BSON injection vulnerability in the legal function in BSON (bson-ruby) gem before 3.0.4 for Ruby allows remote attackers to cause a denial of service (resource consumption) or inject arbitrary data via a crafted string.

In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.


The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.

marginalia < 1.6 is affected by SQL Injection. The impact is an injection of any SQL queries when a user controller argument is added as a component. This issue affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is inputting of SQL to a vulnerable vector (header, http parameter, etc). The fixed version is 1.6.

### Details

A buffer overflow vulnerability exists in `Zlib::GzipReader`.

The `zstream_buffer_ungets` function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity.

### Recommended action

We recommend to update the `zlib` gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

* For Ruby 3.2 users: Update to zlib 3.0.1
* For Ruby 3.3 users: Update to zlib 3.1.2

You can use gem update zlib to update it. If you are using bundler, please add `gem "zlib", ">= 3.2.3"` to your Gemfile.

### Affected versions

zlib gem 3.2.2 or lower

### Credits

[calysteon](https://hackerone.com/calysteon)

### References

* https://hackerone.com/reports/3467067

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.

The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.

Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability

When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.

pdf_info 0.5.3 is vulnerable to Command Execution. An attacker using a specially crafted payload may execute OS commands by using command chaining because during object initalization there is no validation performed and the user provided path is used.

mysql-binuuid-rails 1.1.0 and earlier allows SQL Injection because it removes default string escaping for affected database columns.

A vulnerability classified as critical has been found in prodigasistemas curupira up to 0.1.3. Affected is an unknown function of the file app/controllers/curupira/passwords_controller.rb. The manipulation leads to sql injection. Upgrading to version 0.1.4 is able to address this issue. The name of the patch is 93a9a77896bb66c949acb8e64bceafc74bc8c271. It is recommended to upgrade the affected component. VDB-218394 is the identifier assigned to this vulnerability.

REST client for Ruby (aka rest-client) versions 1.6.1.a until 1.8.0 allow remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.

rubygem-safemode, as used in Foreman, versions 1.3.1 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.

The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.

rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection

### Summary

COSMOS reads configuration from a user-writable overlay (`targets_modified/`) before the read-only plugin-installed `targets/` tree, and the config subsystem executes code on those files: `ConfigParser` renders every file as ERB by default, a `GENERIC_READ_CONVERSION` / `GENERIC_WRITE_CONVERSION` block is evaluated as code by `GenericConversion` (Ruby and Python), and the Script Runner suite analysis `require`s a procedure file. An authenticated user can write into `targets_modified/` below the admin tier (the storage-upload endpoint exempts that area from the admin gate, and the screen-save endpoint stores its body verbatim there), so the same root cause is reachable through several features, each giving arbitrary code execution on a COSMOS server.

Three vulnerable routes were identified, all reachable by an authenticated non-admin user (in the open-source edition `authorize` ignores the permission string, so any authenticated user qualifies):

1. **Table definitions** (immediate). `tables#generate|report|load` reads a definition from `targets_modified/` and ERB-renders it and evaluates its `GENERIC_*_CONVERSION` block in the `cmd-tlm-api` container.
2. **Command/telemetry definitions** (persistent). A file written to `targets_modified/<TARGET>/cmd_tlm/` is overlaid by `System.setup_targets` and processed by `PacketConfig` in the decom/multi microservices: ERB-rendered in the Ruby implementation, and GENERIC-evaluated in both the Ruby and Python implementations (the Python `ConfigParser` does not run ERB). It executes on the next microservice (re)start.
3. **Script Runner suites** (immediate). A procedure written to `targets_modified/<TARGET>/procedures/` is `require`d by the suite analysis, reachable at the read-only `script_view` tier through `scripts#body` and `running_script#show` (the analysis subprocess is spawned when `OPENC3_SERVICE_PASSWORD` is configured, which it is in the shipped `.env`).

### Details

Root cause. `TargetFile.body` (Ruby `openc3/lib/openc3/utilities/target_file.rb`, Python `openc3/python/openc3/utilities/target_file.py`) reads `{scope}/targets_modified/{name}` before `{scope}/targets/{name}`. The storage-upload endpoint `storage_controller.rb get_upload_presigned_request` is gated at `system_set` and exempts `targets_modified/` and `tmp/` from its `admin` check (so a write there is not admin-gated); for a target path it additionally calls `authorize_bucket_path`, which in the permission-enforcing edition requires `tlm` on the target, while in the open-source edition `authorize` ignores the permission string entirely. `screens_controller.rb create` (`system_set`) stores its request body verbatim under `targets_modified/<target>/screens/`. So a non-admin can place files in the overlay. The config subsystem then executes them.

Sink 1, ERB. `ConfigParser#parse_file` renders the file as ERB before parsing (`run_erb` defaults to true):
```ruby
# openc3/lib/openc3/config/config_parser.rb:402
output = ERB.new(File.read(filename)...comment_erb(), trim_mode: "-").result(...)
```
Reached for table definitions via `tables_controller.rb` -> `Table.get_definitions` -> `TableConfig.process_file` -> `parse_file`, and for cmd/tlm definitions via `System.setup_targets` (`system.rb`, whose overlay loop copies `targets_modified/<T>/cmd_tlm/*` over the read-only files) -> `PacketConfig#process_file` -> `parse_file`.

Sink 2, GENERIC conversion. `PacketConfig`/`TableConfig` build a `GenericConversion` from a `GENERIC_READ_CONVERSION_START .. END` / `GENERIC_WRITE_CONVERSION_START .. END` block, and `GenericConversion#call` evaluates it (independent of ERB):
```ruby
# openc3/lib/openc3/conversions/generic_conversion.rb (call)
eval(@code_to_eval)
# Python openc3/python/openc3/conversions/generic_conversion.py (call): compile()/exec()/eval()
```
The read conversion fires on `tables#report`/`load` and during telemetry decom; the write conversion fires on `tables#generate` and on `restore_defaults`.

Sink 3, suite require. The Script Runner suite analysis executes the file:
```ruby
# openc3-cosmos-script-runner-api/scripts/run_suite_analysis.rb:24
require ARGV[1]      # runs all top-level code of the supplied file
```
reached from `Script.process_suite`, invoked by `scripts#body` and `running_script#show` (both `script_view`) and `scripts#create` (`script_edit`) when the file matches the suite pattern.

Permission tiers. Writing the payload needs `system_set` (screen save, storage upload) or `script_edit` (script create); triggering needs `system` (tables) or `script_view` (suite). These are below the tiers where COSMOS gates code execution elsewhere (plugin install requires `admin`, running a script requires `script_run`).

### PoC

Table definition path, against a standard stack. Benign payload writes `id` to a marker file. This PoC uses the open-source password login; in the permission-enforcing edition substitute a bearer token for a user holding the permissions noted above.
```bash
BASE=http://localhost:2900/openc3-api      # adjust to your deployment
TOKEN=$(curl -s -X POST "$BASE/auth/verify" -H 'Content-Type: application/json' -d '{"password":"<your password>"}')

# 1) Write the payload into targets_modified/ via the screen save endpoint.
curl -s -X POST "$BASE/screen" -H "Authorization: $TOKEN" \
  --data-urlencode 'scope=DEFAULT' --data-urlencode 'target=INST' --data-urlencode 'screen=poc' \
  --data-urlencode $'text=SCREEN AUTO AUTO 1.0\n<%= File.write("/tmp/erb_rce_poc", `id`) %>\nLABEL poc'

# 2) Trigger by pointing a table action at that file.
curl -s -X POST "$BASE/tables/generate" -H "Authorization: $TOKEN" \
  --data-urlencode 'scope=DEFAULT' --data-urlencode 'definition=INST/screens/poc.txt'
```
Then in the cmd-tlm-api container: `cat /tmp/erb_rce_poc` shows `uid=1001(openc3) ...`. The `tables/generate` request returns HTTP 500 (the screen lines are not valid table keywords); the marker shows the code already ran.

The same outcome without ERB, using the GENERIC sink, on the same `tables/generate` trigger:
```
TABLE "data" BIG_ENDIAN KEY_VALUE "poc"
  APPEND_PARAMETER "item1" 8 UINT 0 255 0 "Item"
    GENERIC_WRITE_CONVERSION_START
      `id > /tmp/erb_rce_poc`
      0
    GENERIC_WRITE_CONVERSION_END
```

cmd/tlm path: upload a telemetry definition containing the same ERB or GENERIC block to `targets_modified/<TARGET>/cmd_tlm/<file>.txt` via the storage-upload presigned request (`system_set`), then the code runs in that target's decom microservice on its next restart. Suite path: write a suite-shaped procedure to `targets_modified/<TARGET>/procedures/<x>.rb` and call `scripts#body` on it at `script_view`.

The ERB table chain was confirmed end to end over HTTP against a booted Rails and puma instance.

### Impact

Arbitrary code execution as the `openc3` user in the `cmd-tlm-api` container and the per-target decom microservices and the script-runner. Those processes hold the Redis and bucket credentials and sit on the internal service network, so the executed code acts with that authority over configuration, telemetry, and command data across scopes. The API is served through Traefik, which the shipped compose binds to `127.0.0.1:2900`, so a default single-host install is reachable only from the host; a multi-user deployment exposes the web port, and the `AV:N` rating reflects that standard remote-operator exposure.

All paths require valid authentication, and the triggering permissions (`system`/`system_set`/`script_view`) are below the `admin`/`script_run`/plugin-install tiers where COSMOS gates code execution. In the open-source edition `authorize` checks only token validity and does not enforce the permission string, so any authenticated user can perform these requests.

### Suggested fix

The fix is to treat the user-writable overlay as data, never code, and to gate the writers, applied uniformly:
- Load table and cmd/tlm definitions for code-execution paths from the read-only `targets/` tree only, or parse the `targets_modified` overlay with ERB disabled (`run_erb=false`); dynamically-created packet definitions are structural and never need ERB, so this does not regress that feature.
- Allow only admin and the server-side dynamic-packet mechanism to write a `cmd_tlm` overlay; reject non-canonical object keys so a positional path check cannot be bypassed by a key the object store normalizes differently.
- Run the Script Runner suite analysis (which executes the file) only at the `script_run` tier, at every entry point.
- Mirror the definition-read change in the Python implementation.

The initialize method in the Histogram class in `lib/colorscore/histogram.rb` in the colorscore gem before 0.0.5 for Ruby allows context-dependent attackers to execute arbitrary code via shell metacharacters in the (1) `image_path`, (2) `colors`, or (3) `depth` variable.

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 
As a result, omniauth-saml created a [new release](https://github.com/omniauth/omniauth-saml/releases) by upgrading ruby-saml to the patched versions v1.17. 


### Summary
A guest mruby script running inside the Kobako sandbox can execute arbitrary
Ruby in the host process, fully escaping the sandbox.

### Details
A host embeds bound "Service" objects that guest scripts call across the wasm
boundary through the transport dispatcher. The dispatcher passed the
guest-supplied method name straight to `Object#public_send` on the bound
object, with no restriction to the object's own methods:

```ruby
target.public_send(method.to_sym, *args, **kwargs, &block)
```

`public_send` can invoke any public method, including Ruby's ambient
reflection surface. A guest pivots through the public `send` into otherwise
private Kernel methods: a dispatch request with `method = "send"` and
`args = [:eval, "<ruby>"]` evaluates to `target.send(:eval, "<ruby>")`,
running attacker-controlled Ruby in the host. Any bound Service object is
sufficient — no Service-specific behavior is required.

### Proof of Concept
A guest call equivalent to:

```
Service.send(:eval, "<arbitrary host ruby>")
```

executes in the host process and can read or modify host state, spawn
processes, and so on.

### Impact
Complete sandbox escape leading to remote code execution in the host process,
defeating the gem's central guarantee of isolating untrusted mruby scripts.
Any deployment that runs untrusted or attacker-influenced scripts is affected.
All released versions (0.1.0 through 0.9.0) are vulnerable; the dispatcher
carried the same unguarded `public_send` sink under three successive names
(`registry` → `rpc` → `transport`).

### Patches
Fixed in 0.9.1. The dispatcher now rejects any method whose resolved owner is
a core/meta module (`BasicObject`, `Kernel`, `Object`, `Module`, `Class`), so
only methods the bound object itself defines — or dynamically handles via
`method_missing` — remain reachable. The ambient reflection methods (`send`,
`__send__`, `public_send`, `instance_eval`, `instance_exec`, `method`,
`instance_variable_get`, …) are all owned by those modules and are blocked.

### Workarounds
None within the affected versions. Until you can upgrade, do not bind any
host Service object into a sandbox that runs untrusted scripts. Upgrade to
0.9.1.

### References
- GHSA-7pwq-q9jf-539h
- Fix commit: 64f8470

### Credits
Reported and fixed by Ahmed Al Hafoudh.

### Summary
OpenC3 COSMOS contains a critical remote code execution vulnerability reachable through the JSON-RPC API. When a JSON-RPC request uses the string form of certain APIs, attacker-controlled parameter text is parsed into values using String#convert_to_value. For array-like inputs, convert_to_value executes eval().

Because the cmd code path parses the command string before calling authorize(), an unauthenticated attacker can trigger Ruby code execution even though the request ultimately fails authorization (401).

### Impact

Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)


### Patches

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).

### Workarounds

```rb
require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end
```

### References

* https://sakurity.com/blog/2015/02/28/openuri.html

### Credits

This vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.


### For more information

See commit message c7ea001.

If you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).

Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by the IdP) can thus forge a SAML Response/Assertion with arbitrary contents. This would allow the attacker to log in as arbitrary user within the vulnerable system.

This vulnerability was reported by ahacker1 of SecureSAML (ahacker1@securesaml.com)

There is a possible shell escape sequence injection vulnerability in the Lint
and CommonLogger components of Rack.  This vulnerability has been assigned the
CVE identifier CVE-2022-30123.

Versions Affected:  All.
Not affected:       None
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted requests can cause shell escape sequences to be written to
the terminal via Rack's Lint middleware and CommonLogger middleware.  These
escape sequences can be leveraged to possibly execute commands in the victim's
terminal.

Impacted applications will have either of these middleware installed, and
vulnerable apps may have something like this:

```
use Rack::Lint
```

Or

```
use Rack::CommonLogger
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Workarounds
Remove these middleware from your application


CVE ID↕	Published↕	CVSS↑
GHSA-f55g-x8qq-2569	May 3, 2022	Critical 9.8
GHSA-5cqm-crxm-6qpv	Dec 14, 2021	Critical 9.8
GHSA-rxq3-gm4p-5fj4	Oct 24, 2017	Critical 9.8
GHSA-w749-p3v6-hccq	Mar 8, 2022	Critical 9.8
GHSA-vr22-43gj-rx3f	May 24, 2022	Critical 9.8
GHSA-6325-6g32-7p35	Jan 26, 2023	Critical 9.8
GHSA-qpqw-mc85-qvm9	Jul 1, 2022	Critical 9.8
GHSA-gcqq-w6gr-h9j9	Oct 24, 2017	Critical 9.8
GHSA-49pj-69vf-c689	Oct 14, 2019	Critical 9.8
GHSA-r364-2pj4-pf7f	May 27, 2023	Critical 9.8
GHSA-2w67-526p-gm73	Dec 6, 2017	Critical 9.8
GHSA-rc42-jghf-vr8f	Jan 14, 2023	Critical 9.8
GHSA-x487-866m-p8hr	May 26, 2023	Critical 9.8
GHSA-gx5g-xcxj-cx2w	Oct 8, 2018	Critical 9.8
GHSA-7cv3-gvmc-8mq5	May 14, 2022	Critical 9.8
GHSA-5c5f-7vfq-3732	Jun 7, 2022	Critical 9.8
GHSA-m44r-gv6q-9j9r	May 24, 2022	Critical 9.8
GHSA-8jhx-9gf4-hhf5	Sep 27, 2019	Critical 9.8
GHSA-jvgm-pfqv-887x	May 14, 2022	Critical 9.8
GHSA-qfwq-chf4-jvwg	May 14, 2022	Critical 9.8
GHSA-68xg-gqqm-vgj8	Aug 18, 2023	Critical 9.8
GHSA-4vc4-m8qh-g8jm	Mar 12, 2025	Critical 9.8
GHSA-333g-rpr4-7hxq	Aug 20, 2019	Critical 9.8
GHSA-pm55-qfxr-h247	Aug 19, 2022	Critical 9.8
GHSA-6w4m-2xhg-2658	Apr 26, 2023	Critical 9.8
GHSA-mf6w-45cf-qhmp	Aug 15, 2018	Critical 9.8
GHSA-cxf7-qrc5-9446	Mar 1, 2022	Critical 9.8
GHSA-mqm2-cgpr-p4m6	Aug 7, 2020	Critical 9.8
GHSA-r74q-gxcg-73hx	Sep 30, 2019	Critical 9.8
GHSA-h6rj-8r3c-9gpj	Mar 5, 2018	Critical 9.8
GHSA-289m-2964-f8q5	Oct 6, 2023	Critical 9.8
GHSA-754f-8gm6-c4r2	Mar 12, 2025	Critical 9.8
GHSA-4g4c-8gqh-m4vm	Jul 16, 2019	Critical 9.8
GHSA-hrj5-qp7x-rpg6	Jul 26, 2019	Critical 9.8
GHSA-g857-hhfv-j68w	Apr 16, 2026	Critical 9.8
GHSA-mqwr-4qf2-2hcv	May 13, 2022	Critical 9.8
GHSA-x27v-x225-gq8g	Dec 6, 2017	Critical 9.8
GHSA-5ww9-9qp2-x524	Jun 24, 2022	Critical 9.8
GHSA-39v7-xpq4-8884	May 5, 2022	Critical 9.8
GHSA-3hhc-qp5v-9p2j	Jul 12, 2022	Critical 9.8
GHSA-9fh3-j99m-f4v7	Feb 24, 2023	Critical 9.8
GHSA-6j63-35hj-vmcg	Oct 30, 2018	Critical 9.8
GHSA-85gf-wr67-f83w	Jan 16, 2023	Critical 9.8
GHSA-3fhf-6939-qg8p	Aug 13, 2018	Critical 9.8
GHSA-7vxr-6cxg-j3x8	Oct 12, 2021	Critical 9.8
GHSA-5vx5-9q73-wgp4	Oct 24, 2017	Critical 9.8
GHSA-vqqv-v9m2-48p2	Apr 4, 2019	Critical 9.8
GHSA-69p6-wvmq-27gg	Apr 20, 2022	Critical 9.8
GHSA-vmfh-c547-v45h	Oct 6, 2021	Critical 9.8
GHSA-77xq-7c6p-6xp6	May 5, 2022	Critical 9.8
GHSA-jjq7-m736-w977	Sep 23, 2026	Critical 9.9
GHSA-73qw-ww62-m54x	Oct 24, 2017	Critical 10
GHSA-cvp8-5r8g-fhvq	Sep 11, 2024	Critical 10
GHSA-7pwq-q9jf-539h	Aug 18, 2026	Critical 10
GHSA-w757-4qv9-mghp	Jan 13, 2026	Critical 10
GHSA-v222-6mr4-qj29	Mar 31, 2022	Critical 10
GHSA-jw9c-mfg7-9rx2	Sep 10, 2024	Critical 10
GHSA-wq4h-7r42-5hrr	May 27, 2022	Critical 10

Know every vulnerability
before it knows you.

rubygems CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

rubygems CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.