deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7f42-p84j-f58p
Package: sanitize (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0.0, < 4.6.3
Patched in: 4.6.3

Summary: Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

Details:
When Sanitize <= 4.6.2 is used in combination with libxml2 >= 2.9.2, a specially crafted HTML fragment can cause libxml2 to generate improperly escaped output, allowing non-whitelisted attributes to be used on whitelisted elements.

This can allow HTML and JavaScript injection, which could result in XSS if Sanitize's output is served to browsers.
GitHub Security Advisory: GHSA-mgvv-5mxp-xq67
Package: sqlite3 (RUBYGEMS)
Severity: LOW (CVSS 0.0)
Vulnerable versions: = 1.5.0
Patched in: 1.5.1

Summary: SQLite3 addresses vulnerability in packaged version of libsqlite

Details:
### Summary

The rubygem sqlite3 v1.5.1 upgrades the packaged version of libsqlite from v3.39.3 to [v3.39.4](https://sqlite.org/releaselog/3_39_4.html).

libsqlite v3.39.4 addresses a vulnerability described as follows in the release notification:

> Version 3.39.4 is a minimal patch against the prior release that addresses issues found since the
> prior release. In particular, a potential vulnerability in the FTS3 extension has been fixed, so
> this should be considered a security update.
>
> In order to exploit the vulnerability, an attacker must have full SQL access and must be able to
> construct a corrupt database with over 2GB of FTS3 content. The problem arises from a 32-bit
> signed integer overflow.

This vulnerability has not been assigned a CVE and does not have a severity declared.

Please note that this advisory only applies to the sqlite3 gem v1.5.0, and only if the packaged libsqlite is being used. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's libsqlite release announcements.


### Mitigation

Upgrade to the rubygem sqlite3 v1.5.1 or later.

Users who are unable to upgrade the sqlite3 gem may also choose a more complicated mitigation: compile and link sqlite3 against external libsqlite >= 3.39.4 which will also address these same issues.


### References

- Upstream release notes: https://sqlite.org/releaselog/3_39_4.html
- Instructions for compiling against system libraries: https://github.com/sparklemotion/sqlite3-ruby
GitHub Security Advisory: GHSA-4qw4-jpp4-8gvp
Package: commonmarker (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 0.23.6
Patched in: 0.23.6

Summary: Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of service

Details:
### Impact

CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). A polynomial time complexity issue in cmark-gfm's autolink extension may lead to unbounded resource exhaustion and subsequent denial of service.

### Patches

This vulnerability has been patched in the following CommonMarker release:

- v0.23.6

### Workarounds

Disable use of the autolink extension.

### References

https://github.com/gjtorikian/commonmarker/pull/190
https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
https://en.wikipedia.org/wiki/Time_complexity

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github/cmark-gfm](https://github.com/github/cmark-gfm)

### Acknowledgements

We would like to thank [Legit Security](https://www.legitsecurity.com) for reporting this vulnerability.
GitHub Security Advisory: GHSA-88cv-mj24-8w3q
Package: arr-pm (RUBYGEMS)
Severity: HIGH (CVSS 7.0)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 0.0.12
Patched in: 0.0.12

Summary: arr-pm vulnerable to arbitrary shell execution when extracting or listing files contained in a malicious rpm.

Details:
### Impact

Arbitrary shell execution is possible when using RPM::File#files and RPM::File#extract if the RPM contains a malicious "payload compressor" field.

This vulnerability impacts the `extract` and `files` methods of the `RPM::File` class in the affected versions of this library.

### Patches

Version 0.0.12 is available with a fix for these issues.

### Workarounds

When using an affected version of this library (arr-pm), ensure any RPMs being processed contain valid/known payload compressor values. Such values include: gzip, bzip2, xz, zstd, and lzma.

You can check the payload compressor field in an rpm by using the rpm command line tool. For example:

```
% rpm -qp example-1.0-1.x86_64.rpm --qf "%{PAYLOADCOMPRESSOR}\n"
gzip
```

### Impact on known dependent projects

This library is used by [fpm](https://github.com/jordansissel/fpm). The vulnerability may impact fpm only when using the flag `-s rpm` or `--input-type rpm` to convert a malicious rpm to another format. It does not impact creating rpms.

### References

* https://github.com/jordansissel/ruby-arr-pm/pull/14
* https://github.com/jordansissel/ruby-arr-pm/pull/15

### Credit

Thanks to @joernchen for reporting this problem and contributing to the resolution :)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the arr-pm issue tracker](https://github.com/jordansissel/ruby-arr-pm/)
GitHub Security Advisory: GHSA-qcqv-38jg-2r43
Package: pageflow (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 15.0.0, < 15.7.1
Patched in: 15.7.1

Summary: Pageflow vulnerable to insecure direct object reference in membership update endpoint

Details:
### Impact

Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the `manager` role to (including their own). While the `Entity` dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the `/admin/users/{user_id}/memberships/{membership_id}` endpoint containing an additional `membership[entity_id]` parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with `manager` role) to be associated with a different attacker-chosen account instead. Since `account_id`s are enumerable, an attacker can compromise all accounts present on the platform.

### Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.

### For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de 

### Credits

[Positive Security](https://positive.security/)
GitHub Security Advisory: GHSA-qcqv-38jg-2r43
Package: pageflow (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 14.5.2
Patched in: 14.5.2

Summary: Pageflow vulnerable to insecure direct object reference in membership update endpoint

Details:
### Impact

Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the `manager` role to (including their own). While the `Entity` dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the `/admin/users/{user_id}/memberships/{membership_id}` endpoint containing an additional `membership[entity_id]` parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with `manager` role) to be associated with a different attacker-chosen account instead. Since `account_id`s are enumerable, an attacker can compromise all accounts present on the platform.

### Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.

### For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de 

### Credits

[Positive Security](https://positive.security/)
GitHub Security Advisory: GHSA-wrrw-crp8-979q
Package: pageflow (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: >= 15.0.0, < 15.7.1
Patched in: 15.7.1

Summary: Pageflow vulnerable to sensitive user data extraction via Ransack query injection

Details:
### Impact

The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.

Pageflow uses the `ActiveAdmin` Ruby library to provide some management features to its users. `ActiveAdmin` relies on the `Ransack` library to implement search functionality. In its default configuration, `Ransack` will allow for query conditions based on properties of associated database objects [1]. The `*_starts_with`, `*_ends_with` or `*_contains` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.

[1] https://activerecord-hackery.github.io/ransack/going-further/associations/
[2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/

### Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.

### For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de 

### Credits

[Positive Security](https://positive.security/)
GitHub Security Advisory: GHSA-wrrw-crp8-979q
Package: pageflow (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
Vulnerable versions: < 14.5.2
Patched in: 14.5.2

Summary: Pageflow vulnerable to sensitive user data extraction via Ransack query injection

Details:
### Impact

The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to.

Pageflow uses the `ActiveAdmin` Ruby library to provide some management features to its users. `ActiveAdmin` relies on the `Ransack` library to implement search functionality. In its default configuration, `Ransack` will allow for query conditions based on properties of associated database objects [1]. The `*_starts_with`, `*_ends_with` or `*_contains` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force.

[1] https://activerecord-hackery.github.io/ransack/going-further/associations/
[2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/

### Mitigation

Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem.

### For more information

If you have any questions or comments about this advisory email us at info(at)codevise.de 

### Credits

[Positive Security](https://positive.security/)
GitHub Security Advisory: GHSA-6wj9-77wq-jq7p
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Vulnerable versions: < 1.5.4
Patched in: 1.5.4

Summary: Nokogiri is vulnerable to XML External Entity (XXE) attack

Details:
Nokogiri before 1.5.4 is vulnerable to XXE attacks.
GitHub Security Advisory: GHSA-pm55-qfxr-h247
Package: omniauth (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: = 2.0.0.pre.rc1
Patched in: 2.0.0

Summary: OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

Details:
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
GitHub Security Advisory: GHSA-pm55-qfxr-h247
Package: omniauth (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-116: Improper Encoding or Escaping of Output
Vulnerable versions: < 1.9.2
Patched in: 1.9.2

Summary: OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

Details:
lib/omniauth/failure_endpoint.rb in OmniAuth before 1.9.2 (and before 2.0) does not escape the message_key value.
GitHub Security Advisory: GHSA-q2hm-gx3f-h63q
Package: lita-coin (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: = 0.0.3
Patched in: unpatched

Summary: Backdoor / Malicious code

Details:
lita-coin 0.0.3 contains a backdoor mechanism that allows launching of hidden cryptocurrency mining operations inside the project. The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands.
GitHub Security Advisory: GHSA-wj5j-xpcj-45gc
Package: devise_invitable (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 1.3.5
Patched in: 1.3.5

Summary: Cross-Site Request Forgery (CSRF)

Details:
# Withdrawn

Affected versions of the package are vulnerable to Cross-Site Request Forgery (CSRF) attacks.
GitHub Security Advisory: GHSA-33wh-w4m7-c6r8
Package: update_by_case (RUBYGEMS)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 0.1.3
Patched in: 0.1.3

Summary: update_by_case before 0.1.3 can be vulnerable to sql injection

Details:
Before version 0.1.3 `update_by_case` gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses `Arel` instead to construct the resulting sql statement, with sanitized sql.
GitHub Security Advisory: GHSA-vw22-465p-8j5w
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 5.0.0, < 5.3.4
Patched in: 5.3.4

Summary: Tarball permission preservation in puppet

Details:
When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask.

When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.
GitHub Security Advisory: GHSA-vw22-465p-8j5w
Package: puppet (RUBYGEMS)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: < 4.10.10
Patched in: 4.10.10

Summary: Tarball permission preservation in puppet

Details:
When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask.

When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.
GitHub Security Advisory: GHSA-5cm2-9h8c-rvfx
Package: tzinfo (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-23: Relative Path Traversal
Vulnerable versions: >= 1.0.0, < 1.2.10
Patched in: 1.2.10

Summary: TZInfo relative path traversal vulnerability allows loading of arbitrary files

Details:
### Impact

#### Affected versions

  - 0.3.60 and earlier.
  - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).

#### Vulnerability 

With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process.

For example, with version 1.2.9, you can run the following to load a file with path `/tmp/payload.rb`:

```ruby
TZInfo::Timezone.get("foo\n/../../../../../../../../../../../../../../../../tmp/payload")
```

The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem.

TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path. 

This could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis.

Versions 2.0.0 and later are not vulnerable.

### Patches

Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers (commit 9eddbb5c0e682736f61d0dd803b6031a5db9eadf for 0.3.x and commit 9905ca93abf7bf3e387bd592406e403cd18334c7 for 1.2.x).

Note that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. For example if `/tmp/upload` was in the load path, then `TZInfo::Timezone.get('foo')` could load a file with path `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that untrusted files are not placed in a directory on the load path.

### Workarounds

As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.

### For more information

If you have any questions or comments about this advisory:
  - Open an issue in [the tzinfo repository](https://github.com/tzinfo/tzinfo).
GitHub Security Advisory: GHSA-5cm2-9h8c-rvfx
Package: tzinfo (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-23: Relative Path Traversal
Vulnerable versions: < 0.3.61
Patched in: 0.3.61

Summary: TZInfo relative path traversal vulnerability allows loading of arbitrary files

Details:
### Impact

#### Affected versions

  - 0.3.60 and earlier.
  - 1.0.0 to 1.2.9 when used with the Ruby data source (tzinfo-data).

#### Vulnerability 

With the Ruby data source (the tzinfo-data gem for tzinfo version 1.0.0 and later and built-in to earlier versions), time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with `require` on demand. In the affected versions, `TZInfo::Timezone.get` fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, `TZInfo::Timezone.get` can be made to load unintended files with `require`, executing them within the Ruby process.

For example, with version 1.2.9, you can run the following to load a file with path `/tmp/payload.rb`:

```ruby
TZInfo::Timezone.get("foo\n/../../../../../../../../../../../../../../../../tmp/payload")
```

The exact number of parent directory traversals needed will vary depending on the location of the tzinfo-data gem.

TZInfo versions 1.2.6 to 1.2.9 can be made to load files from outside of the Ruby load path. Versions up to and including 1.2.5 can only be made to load files from directories within the load path. 

This could be exploited in, for example, a Ruby on Rails application using tzinfo version 1.2.9, that allows file uploads and has a time zone selector that accepts arbitrary time zone identifiers. The CVSS score and severity have been set on this basis.

Versions 2.0.0 and later are not vulnerable.

### Patches

Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers (commit 9eddbb5c0e682736f61d0dd803b6031a5db9eadf for 0.3.x and commit 9905ca93abf7bf3e387bd592406e403cd18334c7 for 1.2.x).

Note that version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of `tzinfo/definition` within a directory in the load path. For example if `/tmp/upload` was in the load path, then `TZInfo::Timezone.get('foo')` could load a file with path `/tmp/upload/tzinfo/definition/foo.rb`. Applications should ensure that untrusted files are not placed in a directory on the load path.

### Workarounds

As a workaround, the time zone identifier can be validated before passing to `TZInfo::Timezone.get` by ensuring it matches the regular expression `\A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z`.

### For more information

If you have any questions or comments about this advisory:
  - Open an issue in [the tzinfo repository](https://github.com/tzinfo/tzinfo).
GitHub Security Advisory: GHSA-qpqw-mc85-qvm9
Package: awesome_spawn (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 1.2.0
Patched in: 1.2.0

Summary: OS Command Injection in awesome spawn

Details:
Awesome spawn prior to version 1.2.0 contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
GitHub Security Advisory: GHSA-977c-63xq-cgw3
Package: opensearch-ruby (RUBYGEMS)
Severity: HIGH (CVSS 8.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 2.0.0, < 2.0.2
Patched in: 2.0.2

Summary: opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization

Details:
### Impact
A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using YAML.load if the response is of type YAML.

### Patches
The problem has been patched in opensearch-ruby gem version 2.0.2.

### Workarounds
No viable workaround.  Please upgrade to 2.0.2

### References
https://github.com/opensearch-project/opensearch-ruby/pull/77
https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [opensearch-ruby](https://github.com/opensearch-project/opensearch-ruby)
GitHub Security Advisory: GHSA-fj2w-qmjp-3rjm
Package: gollum (RUBYGEMS)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 5.0, < 5.1.2
Patched in: 5.1.2

Summary: Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog

Details:
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
GitHub Security Advisory: GHSA-49pj-69vf-c689
Package: netaddr (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: < 1.5.3
Patched in: 1.5.3

Summary: netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions

Details:
The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
GitHub Security Advisory: GHSA-49pj-69vf-c689
Package: netaddr (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 2.0.0, < 2.0.4
Patched in: 2.0.4

Summary: netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions

Details:
The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
GitHub Security Advisory: GHSA-98mf-8f57-64qf
Package: actionpack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 3.0, < 3.0.17
Patched in: 3.0.17

Summary: actionpack Cross-site Scripting vulnerability

Details:
Cross-site scripting (XSS) vulnerability in `actionpack/lib/action_view/helpers/form_tag_helper.rb` in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the `prompt` field to the `select_tag` helper.