The message function in `lib/webbynode/notify.rb` in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message.

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb script. The issue is triggered when input passed via the code search box is not properly sanitized, which allows strings to be evaluated by the shell. This may allow a remote attacker to execute arbitrary commands.

fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands.

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Withdrawn, accidental duplicate publish.

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

## Duplicate advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-543v-gj2c-r3ch](https://github.com/advisories/GHSA-543v-gj2c-r3ch). This link is maintained to preserve external references.

## Original Description
Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.

Withdrawn, accidental duplicate publish.

The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

The `unpack_zip` function in `archive_unpacker.rb` in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path.

Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.xml`, a different vulnerability than CVE-2013-7224.

### Summary

Nokogiri [v1.13.2](https://github.com/sparklemotion/nokogiri/releases/tag/v1.13.2) upgrades two of its packaged dependencies:

- vendored libxml2 from v2.9.12 to [v2.9.13](https://download.gnome.org/sources/libxml2/2.9/libxml2-2.9.13.news)
- vendored libxslt from v1.1.34 to [v1.1.35](https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.35.news)

Those library versions address the following upstream CVEs:

- libxslt: [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560) (CVSS 8.8, High severity)
- libxml2: [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308) (Unspecified severity, see more information below)

Those library versions also address numerous other issues including performance improvements, regression fixes, and bug fixes, as well as memory leaks and other use-after-free issues that were not assigned CVEs.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.2`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.13.2`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link an older version Nokogiri against external libraries libxml2 `>= 2.9.13` and libxslt `>= 1.1.35`, which will also address these same CVEs.


### Impact

#### libxslt [CVE-2021-30560](https://nvd.nist.gov/vuln/detail/CVE-2021-30560)

- CVSS3 score: 8.8 (High)
- Fixed by https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9c

All versions of libxslt prior to v1.1.35 are affected.

Applications using **untrusted** XSL stylesheets to transform XML are vulnerable to a denial-of-service attack and should be upgraded immediately.


#### libxml2 [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308)

- As of the time this security advisory was published, there is no officially published information available about this CVE's severity. The above NIST link does not yet have a published record, and the libxml2 maintainer has declined to provide a severity score.
- Fixed by https://gitlab.gnome.org/GNOME/libxml2/-/commit/652dd12
- Further explanation is at https://mail.gnome.org/archives/xml/2022-February/msg00015.html

The upstream commit and the explanation linked above indicate that an application may be vulnerable to a denial of service, memory disclosure, or code execution if it parses an **untrusted** document with parse options `DTDVALID` set to true, and `NOENT` set to false.

An analysis of these parse options:

- While `NOENT` is off by default for Document, DocumentFragment, Reader, and Schema parsing, it is on by default for XSLT (stylesheet) parsing in Nokogiri v1.12.0 and later.
- `DTDVALID` is an option that Nokogiri does not set for any operations, and so this CVE applies only to applications setting this option explicitly.

It seems reasonable to assume that any application explicitly setting the parse option `DTDVALID` when parsing **untrusted** documents is vulnerable and should be upgraded immediately.


### Summary

XInclude substitution performed by `Nokogiri::XML::Node#do_xinclude` replaced each `<xi:include>` in place, freeing the include node along with its children (such as `<xi:fallback>` and its descendants) and any namespaces declared on them. If an application had already exposed one of those nodes or namespaces to Ruby, the corresponding Ruby object was left pointing at freed memory. Using the object could result in invalid reads or writes to memory.

Nokogiri 1.19.4 substitutes each `<xi:include>` on a defensive copy by default, so the structures libxml2 frees are never the ones bound to live Ruby objects.

Only the CRuby implementation is affected; JRuby is not affected.

### Severity

The Nokogiri maintainers have evaluated this as low severity. Reaching it requires an unusual API-usage pattern that does not arise during normal use. The application must parse a document without XInclude, traverse into an `<xi:include>` subtree to expose its nodes or namespaces to Ruby, and only then invoke XInclude processing. The common case, requesting XInclude at parse time, operates on a freshly parsed document whose nodes are not yet exposed to Ruby and is not affected. Nokogiri 1.19.4 makes this pattern safe by default and requires no change to application code.

### Mitigation

Upgrade to Nokogiri 1.19.4 or later.

As a workaround for earlier versions, perform XInclude substitution at parse time (with the `xinclude` parse option) rather than calling `#do_xinclude` on a document that has already been traversed. A freshly parsed document has no nodes exposed to Ruby, so the substitution is safe.

### Credit

This issue was responsibly reported by Zheng Yu from depthfirst.com.

There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series


### Summary

Ruby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.start`, `state.cursor`, and `state.end` pointing into released storage.

When `partial_value` reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls `cursor_position`, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using `JSON::ResumableParser` may cause process termination when the application calls `partial_value` on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

* JSON 2.20.0
* JSON 2.21.0
* JSON 2.21.1

The attached evidence demonstrates:

* an AddressSanitizer-confirmed heap-use-after-free;
* a native `SIGSEGV` using the official JSON 2.21.1 RubyGem;
* an end-to-end loopback TCP attacker/victim reproduction;
* four differential controls;
* successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report `#3867755`. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

### Details

The affected source is:

```text
ext/json/ext/parser/parser.c
```

The vulnerable sequence in JSON 2.21.1 is:

1. `cResumableParser_parse` reaches the end of the current input buffer.
2. It calls `json_str_clear(parser->buffer)`.
3. It sets `parser->buffer = Qfalse`.
4. The parser-state pointers into the released buffer are not reset.
5. `partial_value` makes a shallow copy of the parser state.
6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.
7. `cursor_position` walks through the stale input pointers and reads released memory.

Relevant source locations:

* Buffer release:
  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2562-L2569

* Parser-state copy:
  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L2647-L2654

* Stale-pointer read in `cursor_position`:
  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L590-L628

* Duplicate-key handling path:
  https://github.com/ruby/json/blob/fd61def38b9bb859fee7eec8e7d3143600e5b347/ext/json/ext/parser/parser.c#L1196-L1255

When input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:

```c
RSTRING_GETMEM(parser->buffer, start, len);
parser->state.start = start;
parser->state.end = start + len;
parser->state.cursor = parser->state.start + offset;
```

After the current buffer has been consumed, `cResumableParser_parse` clears the string and removes the parser's reference to it:

```c
if (eos(&parser->state)) {
    json_str_clear(parser->buffer);
    parser->buffer = Qfalse;
}
```

This path does not invalidate or replace:

```text
parser->state.start
parser->state.cursor
parser->state.end
```

`JSON::ResumableParser#partial_value` subsequently makes a shallow copy of the parser structure:

```c
JSON_ResumableParser *original_parser = cResumableParser_get(self);
JSON_ResumableParser parser = *original_parser;
```

When the partial object contains duplicate keys, reconstruction follows this call path:

```text
cResumableParser_partial_value_body
  -> json_decode_object
  -> json_on_duplicate_key
  -> emit_duplicate_key_warning
  -> emit_parse_warning
  -> cursor_position
```

`cursor_position` then reads through pointers that may refer to released storage.

AddressSanitizer reports:

```text
ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567
```

The reproducer follows the normal resumable-parser API sequence:

```ruby
parser << chunk
parser.parse
parser << next_chunk
parser.parse
parser.partial_value
```

The issue does not require:

* an application-defined callback;
* explicit garbage collection;
* parser reentrancy;
* custom parser options;
* an attacker-supplied Ruby object;
* manual modification of native parser state.

The release-build crash reproduced on JSON 2.20.0, 2.21.0, and 2.21.1.

This report covers the native C-extension implementation. The separate Java-platform implementation was not tested and is not claimed to be affected.

### PoC

The complete evidence bundle is attached as:

```text
ruby-json-resumable-partial-value-uaf-evidence-20260716.zip
```

SHA-256:

```text
07bf8d47b115e45d6145d0447ab6c1c0255e4a7e9b2fb55c3c9a0e24406134ac
```

#### Requirements

* Linux
* Ruby with development headers
* C compiler
* `make`
* RubyGems

#### Release-build, network, and differential reproduction

Extract the attachment:

```sh
unzip ruby-json-resumable-partial-value-uaf-evidence-20260716.zip
cd ruby-json-resumable-partial-value-uaf-evidence-20260716
```

Run the official JSON 2.21.1 release-build proof, loopback network proof, and differential controls:

```sh
./run_exact_2211.sh
```

Expected primary results:

```text
release_exit=139
network_victim_exit=139
network_result=PASS
result=PASS
```

The following four differential controls must also report `result=PASS`:

```text
unique_key
duplicate_allowed
no_partial
complete_document
```

The release-build crash stack includes:

```text
cursor_position
emit_parse_warning
emit_duplicate_key_warning
json_decode_object
cResumableParser_partial_value_body
```

#### AddressSanitizer reproduction

Run:

```sh
./run_asan.sh
```

Expected vulnerable result:

```text
asan_vulnerable_exit=134
ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by cResumableParser_parse at parser.c:2567
```

Expected patched-control result:

```text
asan_patched_exit=0
asan_result=PASS
```

#### Affected-version matrix

The release-build crash was reproduced three times for each of the following official RubyGems releases:

```text
json 2.20.0
json 2.21.0
json 2.21.1
```

Additional evidence is included in:

```text
artifacts/exact-2211-e2e.txt
artifacts/asan-and-patched-control.txt
artifacts/version-matrix.txt
artifacts/source-and-release-verification.txt
source-slices.txt
prior-art.md
patch-control.diff
```

### Impact

This is a use-after-free that can result in native Ruby process termination.

An attacker must be able to supply JSON stream data to an application that:

1. uses `JSON::ResumableParser`;
2. processes attacker-controlled streaming input;
3. calls `partial_value` after parsing an incomplete document containing duplicate object keys.

In network-facing deployments meeting these conditions, an attacker can cause process termination and denial of service.

The release-build crash was reproduced consistently in the tested Linux environment. The AddressSanitizer result confirms the underlying heap-use-after-free independently of normal allocator behavior.

The demonstrated impact is:

```text
Denial of service through native process termination
```

No confidentiality impact, integrity impact, arbitrary code execution, or information disclosure is claimed.

### Suggested remediation

Before clearing or releasing the resumable parser's input buffer, invalidate or replace every parser-state pointer that refers to the buffer's backing storage.

Delayed code paths such as duplicate-key warning generation must not calculate cursor positions using pointers after the corresponding buffer has been released.

The attached `patch-control.diff` demonstrates one tested control and is provided for validation rather than as a required final implementation.

The xmlreader in libxml allows remote attackers to cause a denial of service (memory consumption) via crafted XML data, related to an XML Entity Expansion (XEE) attack.

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

### Summary

Nokogiri v1.13.9 upgrades the packaged version of its dependency libxml2 to [v2.10.3](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.3) from v2.9.14.

libxml2 v2.10.3 addresses the following known vulnerabilities:

- [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309)
- [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)
- [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.9`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.13.9`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.10.3` which will also address these same issues.


### Impact

#### libxml2 [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309)

- **CVSS3 score**: Under evaluation
- **Type**: Denial of service
- **Description**: NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.

Nokogiri maintainers investigated at #2620 and determined this CVE does not affect Nokogiri users.


#### libxml2 [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)

- **CVSS3 score**: Unspecified upstream
- **Type**: Data corruption, denial of service
- **Description**: When an entity reference cycle is detected, the entity content is cleared by setting its first byte to zero. But the entity content might be allocated from a dict. In this case, the dict entry becomes corrupted leading to all kinds of logic errors, including memory errors like double-frees.

See https://gitlab.gnome.org/GNOME/libxml2/-/commit/644a89e080bced793295f61f18aac8cfad6bece2


#### libxml2 [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)

- **CVSS3 score**: Unspecified upstream
- **Type**: Integer overflow
- **Description**: Integer overflows with XML_PARSE_HUGE

See https://gitlab.gnome.org/GNOME/libxml2/-/commit/c846986356fc149915a74972bf198abc266bc2c0


### References

- [libxml2 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases)
- [CVE-2022-2309](https://nvd.nist.gov/vuln/detail/CVE-2022-2309)
- [CVE-2022-40304](https://nvd.nist.gov/vuln/detail/CVE-2022-40304)
- [CVE-2022-40303](https://nvd.nist.gov/vuln/detail/CVE-2022-40303)


# Withdrawn reason
Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783).  This is no longer considered a vulnerability.

# Original description
agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.

The set_meta_data function in lib/cremefraiche.rb in the Creme Fraiche gem before 0.6.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the file name of an email attachment.  NOTE: some of these details are obtained from third party information.

Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

`rack/file.rb` (`Rack::File`) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted `PATH_INFO` environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on `/tmp/browser.html`.

Multiple cross-site scripting (XSS) vulnerabilities in `app/views/layouts/application.html.haml` in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.

`config/initializers/secret_token.rb` in Fat Free CRM before 0.12.1 has a fixed `FatFreeCRM::Application.config.secret_token` value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.

CRLF injection vulnerability in `actionpack/lib/action_controller/response.rb` in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.

Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.

`lib/active_support/json/backends/yaml.rb` in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released

`lib/puppet/defaults.rb` in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for `last_run_report.yaml`, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

`converter.rb` in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

Withdrawn, accidental duplicate publish.

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.

`chef-server-api/app/controllers/users.rb` in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

There is a denial of service vulnerability in the Content-Disposition parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44571.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause Content-Disposition header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is used typically used in multipart parsing. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.0 series
    2-1-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.1 series
    2-2-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 2.2 series
    3-0-Fix-ReDoS-vulnerability-in-multipart-parser - Patch for 3.0 series


## Summary

Nokogiri v1.18.8 upgrades its dependency libxml2 to [v2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8).

libxml2 v2.13.8 addresses:

- CVE-2025-32414
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/889
- CVE-2025-32415
  - described at https://gitlab.gnome.org/GNOME/libxml2/-/issues/890

## Impact

### CVE-2025-32414: No impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters.

**There is no impact** from this CVE for Nokogiri users.


### CVE-2025-32415: Low impact

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XML document must be validated against an XML schema with certain identity constraints, or a crafted XML schema must be used.

In the upstream issue, further context is provided by the maintainer:

> The bug affects validation against untrusted XML Schemas (.xsd) and validation of untrusted
> documents against trusted Schemas if they make use of xsd:keyref in combination with recursively
> defined types that have additional identity constraints.

MITRE has published a severity score of 2.9 LOW (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) for this CVE.

The `sanitize_css` method in `lib/action_controller/vendor/html-scanner/html/sanitizer.rb` in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle `\n` (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

### Summary

Nokogiri v1.14.3 upgrades the packaged version of its dependency libxml2 to [v2.10.4](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4) from v2.10.3.

libxml2 v2.10.4 addresses the following known vulnerabilities:

- [CVE-2023-29469](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29469): Hashing of empty dict strings isn't deterministic
- [CVE-2023-28484](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28484): Fix null deref in xmlSchemaFixupComplexType
- Schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.14.3`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.14.3`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.10.4` which will also address these same issues.


### Impact

No public information has yet been published about the security-related issues other than the upstream commits. Examination of those changesets indicate that the more serious issues relate to libxml2 dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs.

The commits can be examined at:

- [[CVE-2023-29469] Hashing of empty dict strings isn't deterministic (09a2dd45) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/09a2dd453007f9c7205274623acdd73747c22d64)
- [[CVE-2023-28484] Fix null deref in xmlSchemaFixupComplexType (647e072e) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/647e072ea0a2f12687fa05c172f4c4713fdb0c4f)
- [schemas: Fix null-pointer-deref in xmlSchemaCheckCOSSTDerivedOK (4c6922f7) · Commits · GNOME / libxml2 · GitLab](https://gitlab.gnome.org/GNOME/libxml2/-/commit/4c6922f763ad958c48ff66f82823ae21f2e92ee6)


### Logs password in plaintext

### Impact

Logs the password used in plaintext.  The password should masked in logs to prevent it leaking.

### Patches
Has the problem been patched? What versions should users upgrade to?

### Workarounds
none

### See also
Are there any links users can visit to find out more information?


#### Package Ecosystem
RubyGems

#### Package Name
many_versioned_gem

#### Affected Versions
< 0.2.2

#### Patches
0.2.3

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) `admin/products.json`, (2) `admin/users.json`, or (3) `admin/overview/get_report_data`, related to a "JSON hijacking" issue.

The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.

Withdrawn, accidental duplicate publish.

Multiple directory traversal vulnerabilities in server.rb in Sprockets before 2.0.5, 2.1.x before 2.1.4, 2.2.x before 2.2.3, 2.3.x before 2.3.3, 2.4.x before 2.4.6, 2.5.x before 2.5.1, 2.6.x and 2.7.x before 2.7.1, 2.8.x before 2.8.3, 2.9.x before 2.9.4, 2.10.x before 2.10.2, 2.11.x before 2.11.3, 2.12.x before 2.12.3, and 3.x before 3.0.0.beta.3, as distributed with Ruby on Rails 3.x and 4.x, allow remote attackers to determine the existence of files outside the application root via a ../ (dot dot slash) sequence with (1) double slashes or (2) URL encoding.

`lib/puppet/ssl/certificate_authority.rb` in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.

A vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to **(1)** cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and `/dev/random`; or **(2)** cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a `Puppet::FileBucket::File object`" to write to arbitrary file locations.

Directory traversal vulnerability in `lib/puppet/reports/store.rb` in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a `..` (dot dot) in a node name.

Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.

rack-cors (aka Rack CORS Middleware) 2.0.1 has 0666 permissions for the .rb files.

lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands.

The `self.run_gpg` function in `lib/rgpg/gpg_helper.rb` in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.

multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

Withdrawn, accidental duplicate publish.

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.json`.

The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.

Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.

Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Rails before edge 9606 allows remote attackers to inject arbitrary web script via the input values.

CVE ID↕	Published↕	CVSS↓
GHSA-p65m-qr5x-rrqq	Oct 24, 2017	N/A
GHSA-95xq-v4m2-fq3r	May 17, 2022	N/A
GHSA-w248-xr37-jx8m	Oct 24, 2017	N/A
GHSA-9p3v-wf2w-v29c	Oct 24, 2017	N/A
GHSA-5p9f-55j8-922m	Aug 13, 2018	N/A
GHSA-v543-gqhh-6gww	Sep 17, 2018	N/A
GHSA-xc85-32mf-xpv8	May 5, 2022	N/A
GHSA-9j7m-rjqx-48vh	May 14, 2022	N/A
GHSA-35c4-f3rq-f9g3	Sep 17, 2018	N/A
GHSA-229r-pqp6-8w6g	Oct 24, 2017	N/A
GHSA-h56m-vwxc-3qpw	Oct 24, 2017	N/A
GHSA-xxr8-833v-c7wc	Oct 24, 2017	N/A
GHSA-f25h-3mj6-4jpg	May 17, 2022	N/A
GHSA-fq42-c5rg-92c2	Feb 25, 2022	N/A
GHSA-wfpw-mmfh-qq69	Jun 19, 2026	N/A
GHSA-rqv2-275x-2jq5	Jan 18, 2023	N/A
GHSA-9hj4-r449-hfvc	Aug 7, 2026	N/A
GHSA-q7wx-62r7-j2x7	Aug 8, 2018	N/A
GHSA-g8q2-24jh-5hpc	Jul 27, 2018	N/A
GHSA-2qc6-mcvw-92cw	Oct 18, 2022	N/A
GHSA-h385-52j6-9984	Oct 20, 2020	N/A
GHSA-m6f7-46hw-grcj	Oct 24, 2017	N/A
GHSA-w37c-q653-qg95	Oct 24, 2017	N/A
GHSA-85r7-w5mv-c849	Oct 24, 2017	N/A
GHSA-9hx9-w2j6-rw76	Oct 24, 2017	N/A
GHSA-wcfx-3m6v-4frg	May 17, 2022	N/A
GHSA-g897-cgfc-7q8v	May 17, 2022	N/A
GHSA-hrp6-w4v2-8737	May 17, 2022	N/A
GHSA-fcqf-h4h4-695m	Oct 24, 2017	N/A
GHSA-jmm9-2p29-vh2w	Oct 24, 2017	N/A
GHSA-xgr2-v94m-rc9g	Oct 24, 2017	N/A
GHSA-p84v-45xj-wwqj	Jan 18, 2023	N/A
GHSA-8jxj-9r5f-w3m2	Oct 24, 2017	N/A
GHSA-v6j3-7jrw-hq2p	May 17, 2022	N/A
GHSA-99ch-8mvp-g7m5	Oct 24, 2017	N/A
GHSA-3q5q-f79q-7hr2	Jul 31, 2018	N/A
GHSA-f68m-q26r-64f6	May 17, 2022	N/A
GHSA-93pm-5p5f-3ghx	Jan 18, 2023	N/A
GHSA-5w6v-399v-w3cc	Apr 21, 2025	N/A
GHSA-q759-hwvc-m3jg	Oct 24, 2017	N/A
GHSA-pxvg-2qj5-37jq	Apr 11, 2023	N/A
GHSA-hhxm-4f85-rgr8	Feb 5, 2019	N/A
GHSA-hwrx-wc75-mgh7	May 14, 2022	N/A
GHSA-v9v4-7jp6-8c73	Oct 24, 2017	N/A
GHSA-r4x3-g983-9g48	Oct 10, 2018	N/A
GHSA-q44r-f2hm-v76v	Oct 24, 2017	N/A
GHSA-v58w-6xc2-w799	May 14, 2022	N/A
GHSA-g89m-3wjw-h857	Oct 24, 2017	N/A
GHSA-jxhw-mg8m-2pj8	Oct 24, 2017	N/A
GHSA-785g-282q-pwvx	Feb 26, 2024	N/A
GHSA-q2hm-gx3f-h63q	Feb 23, 2021	N/A
GHSA-jg4m-q6w8-vrjp	Oct 24, 2017	N/A
GHSA-pchc-949f-53m5	Oct 24, 2017	N/A
GHSA-mrhj-2g4v-39qx	Sep 17, 2018	N/A
GHSA-4xq9-vw89-p5cx	May 17, 2022	N/A
GHSA-9whh-582r-589h	May 14, 2022	N/A
GHSA-q6cw-2553-7837	Oct 24, 2017	N/A
GHSA-gm25-fpmr-43fj	Oct 24, 2017	N/A

Know every vulnerability
before it knows you.

rubygems CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

rubygems CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.