deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3hhc-qp5v-9p2j
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: <= 5.2.8
Patched in: 5.2.8.1

Summary: Active Record RCE bug with Serialized Columns

Details:
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
GitHub Security Advisory: GHSA-3hhc-qp5v-9p2j
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 6.0.0, <= 6.0.5
Patched in: 6.0.5.1

Summary: Active Record RCE bug with Serialized Columns

Details:
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
GitHub Security Advisory: GHSA-3hhc-qp5v-9p2j
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 6.1.0, <= 6.1.6
Patched in: 6.1.6.1

Summary: Active Record RCE bug with Serialized Columns

Details:
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
GitHub Security Advisory: GHSA-3hhc-qp5v-9p2j
Package: activerecord (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: >= 7.0.0, <= 7.0.3
Patched in: 7.0.3.1

Summary: Active Record RCE bug with Serialized Columns

Details:
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
GitHub Security Advisory: GHSA-73pr-g6jj-5hc9
Package: ruby-mysql (RUBYGEMS)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Vulnerable versions: < 2.10.0
Patched in: 2.10.0

Summary: Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql

Details:
A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client (and not a "local" file on the server).
GitHub Security Advisory: GHSA-8cw2-jv5c-c825
Package: red-arrow (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-909: Missing Initialization of Resource
Vulnerable versions: >= 0.14.0, < 0.15.1
Patched in: 0.15.1

Summary: Missing Initialization of Resource in Apache Arrow

Details:
It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
GitHub Security Advisory: GHSA-cjw4-2w9r-r8mv
Package: red-arrow (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-909: Missing Initialization of Resource
Vulnerable versions: >= 0.12.0, < 0.15.1
Patched in: 0.15.1

Summary: Missing Initialization of Resource in Apache Arrow

Details:
While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
GitHub Security Advisory: GHSA-5ww9-9qp2-x524
Package: diffy (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
Vulnerable versions: < 3.4.1
Patched in: 3.4.1

Summary: Improper handling of double quotes in file name in Diffy in Windows environment

Details:
The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string.
GitHub Security Advisory: GHSA-34hf-g744-jw64
Package: i18n (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 0.8.0
Patched in: 0.8.0

Summary: i18n Vulnerable to Denial of Service Attack

Details:
Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.
GitHub Security Advisory: GHSA-xc85-32mf-xpv8
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.1.0, < 1.1.6
Patched in: 1.1.6

Summary: Rack arbitrary code execution via timing attack

Details:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
GitHub Security Advisory: GHSA-xc85-32mf-xpv8
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.2.0, < 1.2.8
Patched in: 1.2.8

Summary: Rack arbitrary code execution via timing attack

Details:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
GitHub Security Advisory: GHSA-xc85-32mf-xpv8
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.3.0, < 1.3.10
Patched in: 1.3.10

Summary: Rack arbitrary code execution via timing attack

Details:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
GitHub Security Advisory: GHSA-xc85-32mf-xpv8
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.4.0, < 1.4.5
Patched in: 1.4.5

Summary: Rack arbitrary code execution via timing attack

Details:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
GitHub Security Advisory: GHSA-xc85-32mf-xpv8
Package: rack (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
Vulnerable versions: >= 1.5.0, < 1.5.2
Patched in: 1.5.2

Summary: Rack arbitrary code execution via timing attack

Details:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
GitHub Security Advisory: GHSA-4284-jfhc-f854
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-732: Incorrect Permission Assignment for Critical Resource
Vulnerable versions: < 5.3.2
Patched in: 5.3.2

Summary: Phusion Passenger incorrect permission assignment

Details:
An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
GitHub Security Advisory: GHSA-cv3f-px9r-54hm
Package: passenger (RUBYGEMS)
Severity: MODERATE (CVSS 4.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 5.1.11
Patched in: 5.1.11

Summary: Phusion Passenger information disclosure

Details:
In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
GitHub Security Advisory: GHSA-g28x-pgr3-qqx6
Package: octokit (RUBYGEMS)
Severity: LOW (CVSS 2.5)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: >= 4.23.0, < 4.25.0
Patched in: 4.25.0

Summary: Octokit gem published with world-writable files

Details:
### Impact

Versions [4.23.0](https://rubygems.org/gems/octokit/versions/4.23.0) and [4.24.0](https://rubygems.org/gems/octokit/versions/4.24.0) of the octokit gem were published containing world-writeable files. 

Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. 

Malicious code already present and running on your machine, separate from this package, could modify the gem’s files and change its behavior during runtime.

### Patches
* [octokit 4.25.0](https://rubygems.org/gems/octokit/versions/4.25.0)

### Workarounds
Users can use the previous version of the gem [v4.22.0](https://rubygems.org/gems/octokit/versions/4.22.0). Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
GitHub Security Advisory: GHSA-26qj-cr27-r5c4
Package: octopoller (RUBYGEMS)
Severity: LOW (CVSS 2.5)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: = 0.2.0
Patched in: 0.3.0

Summary: Octopoller gem published with world-writable files

Details:
### Impact

Version [0.2.0](https://rubygems.org/gems/octopoller/versions/0.2.0) of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). 

This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. 

Malicious code already present and running on your machine, separate from this package, could modify the gem’s files and change its behavior during runtime.

### Patches
* octopoller 0.3.0

### Workarounds
Users can use the previous version of the gem [v0.1.0](https://rubygems.org/gems/octopoller/versions/0.1.0). Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
GitHub Security Advisory: GHSA-64qm-hrgp-pgr9
Package: mechanize (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-522: Insufficiently Protected Credentials
Vulnerable versions: < 2.8.5
Patched in: 2.8.5

Summary: Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect

Details:
**Summary**

Mechanize (rubygem) `< v2.8.5` leaks the `Authorization` header after a redirect to a different port on the same site.

**Mitigation**

Upgrade to Mechanize v2.8.5 or later.

**Notes**

See [https://curl.se/docs/CVE-2022-27776.html](CVE-2022-27776) for a similar vulnerability in curl.

Cookies are shared with a server at a different port on the same site, per https://datatracker.ietf.org/doc/html/rfc6265#section-8.5 which states in part:

> Cookies do not provide isolation by port.  If a cookie is readable
> by a service running on one port, the cookie is also readable by a
> service running on another port of the same server.  If a cookie is
> writable by a service on one port, the cookie is also writable by a
> service running on another port of the same server.  For this
> reason, servers SHOULD NOT both run mutually distrusting services on
> different ports of the same host and use cookies to store security-
> sensitive information.
GitHub Security Advisory: GHSA-5c5f-7vfq-3732
Package: jmespath (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 1.6.1
Patched in: 1.6.1

Summary: JMESPath for Ruby uses unsafe JSON.load when safe JSON.parse is preferable

Details:
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
GitHub Security Advisory: GHSA-5g4r-2qhx-vqfm
Package: trilogy (RUBYGEMS)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-908: Use of Uninitialized Resource
Vulnerable versions: < 2.1.1
Patched in: 2.1.1

Summary: Use of Uninitialized Variable in trilogy

Details:
### Impact

When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory.

### Patches

Users of the trilogy gem should upgrade to version 2.1.1

### Workarounds

This issue can be avoided by only connecting to trusted servers.

### Acknowledgements 

We would like to thank Sergei Volokitin for reporting this vulnerability

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trilogy](https://github.com/github/trilogy)
GitHub Security Advisory: GHSA-fj34-jhjx-xmvv
Package: dragonfly (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Vulnerable versions: < 1.4.0
Patched in: 1.4.0

Summary: Arbitrary file write in dragonfly

Details:
An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verify_url option is disabled. This vulnerability is exploited via a crafted URL.
GitHub Security Advisory: GHSA-wmh9-x28j-c6gr
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0, < 9.2.5
Patched in: 9.2.5

Summary: Cross site scripting in publify

Details:
In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
GitHub Security Advisory: GHSA-3h7v-wqw7-ff28
Package: publify_core (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0, < 9.2.5
Patched in: 9.2.5

Summary: Cross site scripting in publify

Details:
In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
GitHub Security Advisory: GHSA-8639-qx56-r428
Package: solidus_backend (RUBYGEMS)
Severity: LOW (CVSS 2.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 3.1.0, < 3.1.6
Patched in: 3.1.6

Summary: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

Details:
### Impact
CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer.

Reproduction steps:
- Take an order's number.
- Log in as an administrator.
- Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column).
- On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`.
- Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site.
- Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`.
- Notice how the adjustments are again finalized.

That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection.

### Patches
Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use.

### References
- [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html).

### For more information
If you have any questions or comments about this advisory:

- Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
- Email us at [security@solidus.io](mailto:security@soliidus.io)
- Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-8639-qx56-r428
Package: solidus_backend (RUBYGEMS)
Severity: LOW (CVSS 2.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 3.0.0, < 3.0.6
Patched in: 3.0.6

Summary: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

Details:
### Impact
CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer.

Reproduction steps:
- Take an order's number.
- Log in as an administrator.
- Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column).
- On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`.
- Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site.
- Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`.
- Notice how the adjustments are again finalized.

That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection.

### Patches
Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use.

### References
- [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html).

### For more information
If you have any questions or comments about this advisory:

- Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
- Email us at [security@solidus.io](mailto:security@soliidus.io)
- Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-8639-qx56-r428
Package: solidus_backend (RUBYGEMS)
Severity: LOW (CVSS 2.3)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: < 2.11.16
Patched in: 2.11.16

Summary: CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend

Details:
### Impact
CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer.

Reproduction steps:
- Take an order's number.
- Log in as an administrator.
- Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column).
- On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`.
- Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site.
- Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`.
- Notice how the adjustments are again finalized.

That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection.

### Patches
Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use.

### References
- [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html).

### For more information
If you have any questions or comments about this advisory:

- Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
- Email us at [security@solidus.io](mailto:security@soliidus.io)
- Contact the core team on [Slack](http://slack.solidus.io/)
GitHub Security Advisory: GHSA-wq4h-7r42-5hrr
Package: rack (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 2.2, <= 2.2.3.0
Patched in: 2.2.3.1

Summary: Possible shell escape sequence injection vulnerability in Rack

Details:
There is a possible shell escape sequence injection vulnerability in the Lint
and CommonLogger components of Rack.  This vulnerability has been assigned the
CVE identifier CVE-2022-30123.

Versions Affected:  All.
Not affected:       None
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted requests can cause shell escape sequences to be written to
the terminal via Rack's Lint middleware and CommonLogger middleware.  These
escape sequences can be leveraged to possibly execute commands in the victim's
terminal.

Impacted applications will have either of these middleware installed, and
vulnerable apps may have something like this:

```
use Rack::Lint
```

Or

```
use Rack::CommonLogger
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Workarounds
Remove these middleware from your application
GitHub Security Advisory: GHSA-wq4h-7r42-5hrr
Package: rack (RUBYGEMS)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
Vulnerable versions: >= 2.1, <= 2.1.4.0
Patched in: 2.1.4.1

Summary: Possible shell escape sequence injection vulnerability in Rack

Details:
There is a possible shell escape sequence injection vulnerability in the Lint
and CommonLogger components of Rack.  This vulnerability has been assigned the
CVE identifier CVE-2022-30123.

Versions Affected:  All.
Not affected:       None
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted requests can cause shell escape sequences to be written to
the terminal via Rack's Lint middleware and CommonLogger middleware.  These
escape sequences can be leveraged to possibly execute commands in the victim's
terminal.

Impacted applications will have either of these middleware installed, and
vulnerable apps may have something like this:

```
use Rack::Lint
```

Or

```
use Rack::CommonLogger
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Workarounds
Remove these middleware from your application