deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-46j2-xjgp-jrfm
Package: activeresource (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-863: Incorrect Authorization
Vulnerable versions: >= 3.0.0.rc, < 5.1.1
Patched in: 5.1.1

Summary: Information disclosure issue in Active Resource

Details:
There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.
GitHub Security Advisory: GHSA-8xww-x3g3-6jcv
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 4.0.0.beta1, < 6.1.7.1
Patched in: 6.1.7.1

Summary: ReDoS based DoS vulnerability in Action Dispatch

Details:
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1

Impact

A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.

Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 6.1 series
    7-0-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
GitHub Security Advisory: GHSA-8fm5-gg2f-f66q
Package: publify_core (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 10.0.2
Patched in: 10.0.2

Summary: Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction

Details:
### Summary
A publisher on a `publify` application is able to perform a cross-site scripting attack on an administrator using the redirect functionality.

### Details
A publisher on a `publify` application is able to perform a cross-site scripting attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link.

We can create a redirect to a `javascript:alert()` URL. Whilst the redirect itself doesn't work, on the administrative panel, an a tag is created with the payload as the URI. Upon clicking this link, the XSS is triggered. 

An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link.

### PoC
A publisher can create a new redirect as shown below. The payload used is `javascript:alert()`.
![image](https://user-images.githubusercontent.com/44903767/295206083-3cf432c6-1f58-49a2-b09c-777e9707e0ff.png)

An administrator will now see this redirect in their overview of the page.
![image](https://user-images.githubusercontent.com/44903767/295206204-3d4dc59a-8f82-42f3-98b2-a[PII_REDACTED]f.png)

If they click the link on the right, it triggers the XSS.
![image](https://user-images.githubusercontent.com/44903767/295206292-3fea85f5-6918-4eff-8206-4a275a6e79e4.png)

### Impact
A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator.
GitHub Security Advisory: GHSA-pfqj-w6r6-g86v
Package: pitchfork (RUBYGEMS)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Vulnerable versions: < 0.11.0
Patched in: 0.11.0

Summary: Pitchfork HTTP Request/Response Splitting vulnerability

Details:
### Impact
HTTP Response Header Injection in Pitchfork Versions < 0.11.0 when used in conjunction with Rack 3

### Patches
The issue was fixed in Pitchfork release 0.11.0

### Workarounds
There are no known work arounds. Users must upgrade.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.2.0, < 2.2.17
Patched in: 2.2.17

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-mrxw-mxhj-p664
Package: nokogiri (RUBYGEMS)
Severity: HIGH (CVSS 7.8)
CWE: CWE-416: Use After Free, CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 1.18.4
Patched in: 1.18.4

Summary: Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

Details:
## Summary

Nokogiri v1.18.4 upgrades its dependency libxslt to [v1.1.43](https://gitlab.gnome.org/GNOME/libxslt/-/releases/v1.1.43).

libxslt v1.1.43 resolves:

- CVE-2025-24855: Fix use-after-free of XPath context node
- CVE-2024-55549: Fix UAF related to excluded namespaces

## Impact

### CVE-2025-24855

- "Use-after-free due to xsltEvalXPathStringNs leaking xpathCtxt->node"
- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/128
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2025-24855

### CVE-2024-55549

- "Use-after-free related to excluded result prefixes"
- MITRE has rated this 7.8 High CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
- Upstream report: https://gitlab.gnome.org/GNOME/libxslt/-/issues/127
- NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2024-55549
GitHub Security Advisory: GHSA-rp28-mvq3-wf8j
Package: camaleon_cms (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Vulnerable versions: < 2.9.1
Patched in: 2.9.1

Summary: Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment

Details:
A Privilege Escalation through a Mass Assignment exists in Camaleon CMS

When a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit! method, which allows all parameters to pass through without any filtering.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.11.5, < 1.11.11
Patched in: 1.11.11

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.1.0, < 2.1.15
Patched in: 2.1.15

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-754f-8gm6-c4r2
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature, CWE-436: Interpretation Conflict
Vulnerable versions: < 1.12.4
Patched in: 1.12.4

Summary: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

Details:
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.
GitHub Security Advisory: GHSA-754f-8gm6-c4r2
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature, CWE-436: Interpretation Conflict
Vulnerable versions: >= 1.13.0, < 1.18.0
Patched in: 1.18.0

Summary: Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)

Details:
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.
GitHub Security Advisory: GHSA-4vc4-m8qh-g8jm
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature, CWE-436: Interpretation Conflict
Vulnerable versions: >= 1.13.0, < 1.18.0
Patched in: 1.18.0

Summary: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Details:
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.
GitHub Security Advisory: GHSA-4vc4-m8qh-g8jm
Package: ruby-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 9.8)
CWE: CWE-347: Improper Verification of Cryptographic Signature, CWE-436: Interpretation Conflict
Vulnerable versions: < 1.12.4
Patched in: 1.12.4

Summary: Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)

Details:
### Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential.
ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.

### Impact
This issue may lead to authentication bypass.
GitHub Security Advisory: GHSA-92rq-c8cf-prrq
Package: ruby-saml (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.13.0, < 1.18.0
Patched in: 1.18.0

Summary: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

Details:
### Summary
ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses.

Ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after.

### Impact
This issue may lead to remote Denial of Service (DoS).
GitHub Security Advisory: GHSA-92rq-c8cf-prrq
Package: ruby-saml (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.12.4
Patched in: 1.12.4

Summary: Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses

Details:
### Summary
ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses.

Ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after.

### Impact
This issue may lead to remote Denial of Service (DoS).
GitHub Security Advisory: GHSA-hw46-3hmr-x9xv
Package: omniauth-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 1.10.6
Patched in: 1.10.6

Summary: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

Details:
### Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.

Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.

### Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
GitHub Security Advisory: GHSA-hw46-3hmr-x9xv
Package: omniauth-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 2.0.0, < 2.1.3
Patched in: 2.1.3

Summary: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

Details:
### Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.

Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.

### Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
GitHub Security Advisory: GHSA-hw46-3hmr-x9xv
Package: omniauth-saml (RUBYGEMS)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 2.2.0, < 2.2.3
Patched in: 2.2.3

Summary: omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue

Details:
### Summary
There are 2 new Critical Signature Wrapping Vulnerabilities (CVE-2025-25292, CVE-2025-25291) and a potential DDOS Moderated Vulneratiblity (CVE-2025-25293) affecting ruby-saml, a dependency of omniauth-saml.

The fix will be applied to ruby-saml and released 12 March 2025, under version 1.18.0.

Please [upgrade](https://github.com/omniauth/omniauth-saml/blob/master/omniauth-saml.gemspec#L16) the ruby-saml requirement to v1.18.0.

### Impact
Signature Wrapping Vulnerabilities allows an attacker to impersonate a user.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.12.0, < 1.12.25
Patched in: 1.12.25

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 1.13.0, < 1.13.24
Patched in: 1.13.24

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.0.0, < 2.0.32
Patched in: 2.0.32

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.3.0, < 2.3.21
Patched in: 2.3.21

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-q92j-grw3-h492
Package: graphql (RUBYGEMS)
Severity: CRITICAL (CVSS 9.0)
CWE: CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: >= 2.4.0, < 2.4.13
Patched in: 2.4.13

Summary: graphql allows remote code execution when loading a crafted GraphQL schema

Details:
# Summary

Loading a malicious schema definition in `GraphQL::Schema.from_introspection` (or `GraphQL::Schema::Loader.load`) can result in remote code execution. Any system which loads a schema by JSON from an untrusted source is vulnerable, including those that use [GraphQL::Client](https://github.com/github-community-projects/graphql-client) to load external schemas via GraphQL introspection.
GitHub Security Advisory: GHSA-9m3q-rhmv-5q44
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-125: Out-of-bounds Read
Vulnerable versions: >= 2.10.0, <= 2.10.1
Patched in: 2.10.2

Summary: Out-of-bounds Read in Ruby JSON Parser 

Details:
### Impact

A specially crafted document could cause an out of bound read, most likely resulting in a crash.

Versions 2.10.0 and 2.10.1 are impacted. Older versions are not.

### Patches

Version 2.10.2 fixes the problem.

### Workarounds

None.
GitHub Security Advisory: GHSA-7wqh-767x-r66v
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 3.1, < 3.1.12
Patched in: 3.1.12

Summary: Local File Inclusion in Rack::Static

Details:
## Summary

`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.

## Details

The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.

## Impact

By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Static`, or
- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.

It is likely that a CDN or similar static file server would also mitigate the issue.
GitHub Security Advisory: GHSA-7wqh-767x-r66v
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 3.0, < 3.0.14
Patched in: 3.0.14

Summary: Local File Inclusion in Rack::Static

Details:
## Summary

`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.

## Details

The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.

## Impact

By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Static`, or
- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.

It is likely that a CDN or similar static file server would also mitigate the issue.
GitHub Security Advisory: GHSA-7wqh-767x-r66v
Package: rack (RUBYGEMS)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: < 2.2.13
Patched in: 2.2.13

Summary: Local File Inclusion in Rack::Static

Details:
## Summary

`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.

## Details

The vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.

## Impact

By exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.

## Mitigation

- Update to the latest version of Rack, or
- Remove usage of `Rack::Static`, or
- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.

It is likely that a CDN or similar static file server would also mitigate the issue.