deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r4mg-4433-c7g3
Package: activestorage (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
Vulnerable versions: >= 8.0, < 8.0.2.1
Patched in: 8.0.2.1

Summary: Active Storage allowed transformation methods that were potentially unsafe

Details:
Active Storage attempts to prevent the use of potentially unsafe image transformation methods and parameters by default.

The default allowed list contains three methods allowing for the circumvention of the safe defaults which enables potential command injection vulnerabilities in cases where arbitrary user supplied input is accepted as valid transformation methods or parameters.

This has been assigned the CVE identifier CVE-2025-24293.


Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.1.5.2, 7.2.2.2, 8.0.2.1

Impact
------
This vulnerability impacts applications that use Active Storage with the image_processing processing gem in addition to mini_magick as the image processor.

Vulnerable code will look something similar to this:

```
<%= image_tag blob.variant(params[:t] => params[:v]) %>
```

Where the transformation method or its arguments are untrusted arbitrary input.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases
--------
The fixed releases are available at the normal locations.

Workarounds
-----------
Consuming user supplied input for image transformation methods or their parameters is unsupported behavior and should be considered dangerous.

Strict validation of user supplied methods and parameters should be performed as well as having a strong [ImageMagick security policy](https://imagemagick.org/script/security-policy.php) deployed.

Credits
-------

Thank you [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this!
GitHub Security Advisory: GHSA-76r7-hhxj-r776
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 0, < 7.1.5.2
Patched in: 7.1.5.2

Summary: Active Record logging vulnerable to ANSI escape injection

Details:
This vulnerability has been assigned the CVE identifier CVE-2025-55193

### Impact
The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

### Releases
The fixed releases are available at the normal locations.

### Credits

Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
GitHub Security Advisory: GHSA-76r7-hhxj-r776
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 7.2, < 7.2.2.2
Patched in: 7.2.2.2

Summary: Active Record logging vulnerable to ANSI escape injection

Details:
This vulnerability has been assigned the CVE identifier CVE-2025-55193

### Impact
The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

### Releases
The fixed releases are available at the normal locations.

### Credits

Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
GitHub Security Advisory: GHSA-76r7-hhxj-r776
Package: activerecord (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 8.0, < 8.0.2.1
Patched in: 8.0.2.1

Summary: Active Record logging vulnerable to ANSI escape injection

Details:
This vulnerability has been assigned the CVE identifier CVE-2025-55193

### Impact
The ID passed to `find` or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences.

### Releases
The fixed releases are available at the normal locations.

### Credits

Thanks to [lio346](https://hackerone.com/lio346) from Unit 515 of OPSWAT for reporting this vulnerability
GitHub Security Advisory: GHSA-6628-q6j9-w8vg
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-617: Reachable Assertion
Vulnerable versions: >= 1.51.0, < 1.53.0
Patched in: 1.53.0

Summary: gRPC Reachable Assertion issue

Details:
There exists an vulnerability causing an abort() to be called in gRPC. 
The following headers cause gRPC's C++ implementation to abort() when called via http2:

te: x (x != trailers)

:scheme: x (x != http, https)

grpclb_client_stats: x (x == anything)

On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: grpc (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-9hxf-ppjv-w6rq
Package: grpc (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: gRPC connection termination issue

Details:
gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.54.0, < 1.54.2
Patched in: 1.54.2

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-cfgp-2977-2fmm
Package: grpc (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-440: Expected Behavior Violation
Vulnerable versions: >= 1.53.0, < 1.53.1
Patched in: 1.53.1

Summary: Connection confusion in gRPC

Details:
When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK table mutations to also be skipped, resulting in a desynchronization of HPACK tables between sender and receiver. If leveraged, say, between a proxy and a backend, this could lead to requests from the proxy being interpreted as containing headers from different proxy clients - leading to an information leak that can be used for privilege escalation or data exfiltration.
GitHub Security Advisory: GHSA-4q53-fqhc-cr46
Package: ember-source (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 1.4.0.beta.1, < 1.4.0.beta.6
Patched in: 1.4.0.beta.6

Summary: ember-source Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
GitHub Security Advisory: GHSA-jf85-cpcp-j695
Package: lodash-rails (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 4.17.12
Patched in: 4.17.12

Summary: Prototype Pollution in lodash

Details:
Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution.  The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.

## Recommendation

Update to version 4.17.12 or later.
GitHub Security Advisory: GHSA-4xc9-xhrj-v574
Package: lodash-rails (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 4.17.11
Patched in: 4.17.11

Summary: Prototype Pollution in lodash

Details:
Versions of `lodash` before 4.17.11 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.11 or later.
GitHub Security Advisory: GHSA-fvqr-27wr-82fm
Package: lodash-rails (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-471: Modification of Assumed-Immutable Data (MAID), CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: < 4.17.5
Patched in: 4.17.5

Summary: Prototype Pollution in lodash

Details:
Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.5 or later.
GitHub Security Advisory: GHSA-p6mc-m468-83gw
Package: lodash-rails (RUBYGEMS)
Severity: HIGH (CVSS 7.4)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling, CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerable versions: >= 3.7.0, < 4.17.19
Patched in: 4.17.19

Summary: Prototype Pollution in lodash

Details:
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions `pick`, `set`, `setWith`, `update`, `updateWith`, and `zipObjectDeep` allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.
GitHub Security Advisory: GHSA-35jh-r3h4-6jhm
Package: lodash-rails (RUBYGEMS)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 4.17.21
Patched in: 4.17.21

Summary: Command Injection in lodash

Details:
`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
GitHub Security Advisory: GHSA-c7p4-hx26-pr73
Package: jwe (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-354: Improper Validation of Integrity Check Value
Vulnerable versions: <= 1.1.0
Patched in: 1.1.1

Summary: JWE is missing AES-GCM authentication tag validation in encrypted JWE

Details:
### Overview
The authentication tag of encrypted JWEs can be brute forced, which may result in loss of confidentiality for those JWEs and provide ways to craft arbitrary JWEs.

### Impact
- JWEs can be modified to decrypt to an arbitrary value
- JWEs can be decrypted by observing parsing differences
- The GCM internal [GHASH key](https://en.wikipedia.org/wiki/Galois/Counter_Mode#:~:text=\)%20is%20the-,hash%20key,-%2C%20a%20string%20of) can be recovered


### Am I Affected?
You are affected by this vulnerability even if you do not use an `AES-GCM` encryption algorithm for your JWEs.

### Patches
The version 1.1.1 fixes the issue by adding the tag length check for the `AES-GCM` algorithm.

**Important:** As the [GHASH key](https://en.wikipedia.org/wiki/Galois/Counter_Mode#:~:text=\)%20is%20the-,hash%20key,-%2C%20a%20string%20of) could have leaked, you must rotate the encryption keys after upgrading to version 1.1.1.

### References
[Félix Charette talk at NorthSec 2025 about the issue](https://www.youtube.com/watch?v=9IT659uUXfs&t=15830s)
GitHub Security Advisory: GHSA-rrqh-93c8-j966
Package: ruby-saml (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.18.1
Patched in: 1.18.1

Summary: Ruby SAML DOS vulnerability with large SAML response

Details:
### Summary
A denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion.

### Details
`ruby-saml` includes a `message_max_bytesize` setting intended to prevent DOS attacks and decompression bombs. However, this protection is ineffective in some cases due to the order of operations in the code:

https://github.com/SAML-Toolkits/ruby-saml/blob/fbbedc978300deb9355a8e[PII_REDACTED]74ef2e67/lib/onelogin/ruby-saml/saml_message.rb

```ruby
      def decode_raw_saml(saml, settings = nil)
        return saml unless base64_encoded?(saml) # <--- Issue here. Should be moved after next code block.

        settings = OneLogin::RubySaml::Settings.new if settings.nil?
        if saml.bytesize > settings.message_max_bytesize
          raise ValidationError.new("Encoded SAML Message exceeds " + settings.message_max_bytesize.to_s + " bytes, so was rejected")
        end

        decoded = decode(saml)
        ...
      end
```

The vulnerability is in the execution order. Prior to checking bytesize the `base64_encoded?` function performs regex matching on the entire input string:

```ruby
!!string.gsub(/[\r\n]|\\r|\\n|\s/, "").match(BASE64_FORMAT)
```

### Impact
_What kind of vulnerability is it? Who is impacted?_

When successfully exploited, this vulnerability can lead to:

- Excessive memory consumption
- High CPU utilization
- Application slowdown or unresponsiveness
- Complete application crash in severe cases
- Potential denial of service for legitimate users

All applications using `ruby-saml` with SAML configured and enabled are vulnerable.

### Potential Solution

Reorder the validation steps to ensure max bytesize is checked first

```ruby
def decode_raw_saml(saml, settings = nil)
  settings = OneLogin::RubySaml::Settings.new if settings.nil?

  if saml.bytesize > settings.message_max_bytesize
    raise ValidationError.new("Encoded SAML Message exceeds " + settings.message_max_bytesize.to_s + " bytes, so was rejected")
  end
  
  return saml unless base64_encoded?(saml)
  decoded = decode(saml)
  ...
end
```
GitHub Security Advisory: GHSA-mqcp-p2hv-vw6x
Package: thor (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: Withdrawn Advisory: Thor can construct an unsafe shell command from library input.

Details:
### Withdrawn Advisory
This advisory has been withdrawn because the method described can only be used with arguments that are controlled by Thor, and an external attacker cannot access the functionality described in the body of the CVE. This link is maintained to preserve external references.

### Original Description
Thor before 1.4.0 can construct an unsafe shell command from library input.
GitHub Security Advisory: GHSA-29g5-m8v7-v564
Package: measured (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 3.2.1
Patched in: 3.2.1

Summary: Measured is vulnerable to Path Traversal attacks during class initialization

Details:
### Impact
A path traversal vulnerability exists where an attacker with access to manipulate inputs when initializing the `Measured::Cache::Json class` would be able to instruct the library to read arbitrary files.

### Patches
Users should update to the latest version.
GitHub Security Advisory: GHSA-xh69-987w-hrp8
Package: resolv (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: >= 0.3.0, < 0.3.1
Patched in: 0.3.1

Summary: resolv vulnerable to DoS via insufficient DNS domain name length validation

Details:
A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.

## Details
The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting
length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

## Affected Version
The vulnerability affects the resolv gem bundled with the following Ruby series:
* Ruby 3.2 series: resolv version 0.2.2 and earlier
* Ruby 3.3 series: resolv version 0.3.0
* Ruby 3.4 series: resolv version 0.6.1 and earlier

## Credits
Thanks to Manu for discovering this issue.

## History
Originally published at 2025-07-08 07:00:00 (UTC)
GitHub Security Advisory: GHSA-xh69-987w-hrp8
Package: resolv (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: >= 0.4.0, < 0.6.2
Patched in: 0.6.2

Summary: resolv vulnerable to DoS via insufficient DNS domain name length validation

Details:
A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.

## Details
The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting
length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

## Affected Version
The vulnerability affects the resolv gem bundled with the following Ruby series:
* Ruby 3.2 series: resolv version 0.2.2 and earlier
* Ruby 3.3 series: resolv version 0.3.0
* Ruby 3.4 series: resolv version 0.6.1 and earlier

## Credits
Thanks to Manu for discovering this issue.

## History
Originally published at 2025-07-08 07:00:00 (UTC)
GitHub Security Advisory: GHSA-xh69-987w-hrp8
Package: resolv (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1284: Improper Validation of Specified Quantity in Input
Vulnerable versions: < 0.2.3
Patched in: 0.2.3

Summary: resolv vulnerable to DoS via insufficient DNS domain name length validation

Details:
A denial of service vulnerability has been discovered in the resolv gem bundled with Ruby.

## Details
The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet.

An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the resolv library parses such a packet, the name decompression process consumes a large amount of CPU resources, as the library does not limit the resulting
length of the name.

This resource consumption can cause the application thread to become unresponsive, resulting in a Denial of Service condition.

## Affected Version
The vulnerability affects the resolv gem bundled with the following Ruby series:
* Ruby 3.2 series: resolv version 0.2.2 and earlier
* Ruby 3.3 series: resolv version 0.3.0
* Ruby 3.4 series: resolv version 0.6.1 and earlier

## Credits
Thanks to Manu for discovering this issue.

## History
Originally published at 2025-07-08 07:00:00 (UTC)
GitHub Security Advisory: GHSA-6qjf-g333-pv38
Package: job-iteration (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.11
Patched in: 1.11

Summary: Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

Details:
### Impact
There is an arbitrary code execution vulnerability in the `CsvEnumerator` class of the `job-iteration` repository. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data leakage, or complete system compromise.

### Patches
Issue is fixed in versions `1.11.0` and above.

### Workarounds
Users can mitigate the risk by avoiding the use of untrusted input in the `CsvEnumerator` class and ensuring that any file paths are properly sanitized and validated before being passed to the class methods. Users should avoid calling `count_of_rows_in_file` on enumerators constructed with untrusted CSV filenames.
GitHub Security Advisory: GHSA-hqp6-mjw3-f586
Package: vagrant (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection'), CWE-276: Incorrect Default Permissions, CWE-668: Exposure of Resource to Wrong Sphere
Vulnerable versions: >= 2.2.10, < 2.4.7
Patched in: 2.4.7

Summary: HashiCorp Vagrant has code injection vulnerability through default synced folders

Details:
An authenticated virtual machine escape vulnerability exists in HashiCorp Vagrant versions 2.4.6 and below when using the default synced folder configuration. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant (or C:\vagrant on Windows). This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagrant command is executed in the project directory. If a low-privileged attacker obtains shell access to the guest VM, they can append arbitrary Ruby code to the mounted Vagrantfile. When a user on the host later runs any vagrant command, the injected code is executed on the host with that user’s privileges.

While this shared-folder behavior is well-documented by Vagrant, the security implications of Vagrantfile execution from guest-writable storage are not explicitly addressed. This effectively enables guest-to-host code execution in multi-tenant or adversarial VM scenarios.