deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r46p-8f7g-vvvg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: < 7.2.3.1
Patched in: 7.2.3.1

Summary: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Details:
### Impact
When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)
GitHub Security Advisory: GHSA-r46p-8f7g-vvvg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 8.0.0.beta1, < 8.0.4.1
Patched in: 8.0.4.1

Summary: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Details:
### Impact
When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)
GitHub Security Advisory: GHSA-r46p-8f7g-vvvg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-789: Memory Allocation with Excessive Size Value
Vulnerable versions: >= 8.1.0.beta1, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests

Details:
### Impact
When serving files through Active Storage's `Blobs::ProxyController`, the controller loads the entire requested byte range into memory before sending it. A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone user [pirikara](https://hackerone.com/pirikara)
GitHub Security Advisory: GHSA-qcfx-2mfw-w4cg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-925: Improper Verification of Intent by Broadcast Receiver
Vulnerable versions: < 7.2.3.1
Patched in: 7.2.3.1

Summary: Rails Active Storage has possible content type bypass via metadata in direct uploads

Details:
### Impact
Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a malicious direct-upload client could set these flags.

### Releases
The fixed releases are available at the normal locations.

### Credit
This was responsible reported by Hackerone researcher [pwnie](https://hackerone.com/pwnie)
GitHub Security Advisory: GHSA-qcfx-2mfw-w4cg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-925: Improper Verification of Intent by Broadcast Receiver
Vulnerable versions: >= 8.0.0.beta1, < 8.0.4.1
Patched in: 8.0.4.1

Summary: Rails Active Storage has possible content type bypass via metadata in direct uploads

Details:
### Impact
Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a malicious direct-upload client could set these flags.

### Releases
The fixed releases are available at the normal locations.

### Credit
This was responsible reported by Hackerone researcher [pwnie](https://hackerone.com/pwnie)
GitHub Security Advisory: GHSA-qcfx-2mfw-w4cg
Package: activestorage (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-925: Improper Verification of Intent by Broadcast Receiver
Vulnerable versions: >= 8.1.0.beta1, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails Active Storage has possible content type bypass via metadata in direct uploads

Details:
### Impact
Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a malicious direct-upload client could set these flags.

### Releases
The fixed releases are available at the normal locations.

### Credit
This was responsible reported by Hackerone researcher [pwnie](https://hackerone.com/pwnie)
GitHub Security Advisory: GHSA-89vf-4333-qx8v
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.2.3.1
Patched in: 7.2.3.1

Summary: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Details:
### Impact
`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by @ch4n3-yoon
GitHub Security Advisory: GHSA-89vf-4333-qx8v
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0.0.beta1, < 8.0.4.1
Patched in: 8.0.4.1

Summary: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Details:
### Impact
`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by @ch4n3-yoon
GitHub Security Advisory: GHSA-89vf-4333-qx8v
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.1.0.beta1, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%

Details:
### Impact
`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by @ch4n3-yoon
GitHub Security Advisory: GHSA-cg4j-q9v8-6v38
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: < 7.2.3.1
Patched in: 7.2.3.1

Summary: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Details:
### Impact
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [scyoon](https://hackerone.com/scyoon).
GitHub Security Advisory: GHSA-cg4j-q9v8-6v38
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 8.0.0.beta1, < 8.0.4.1
Patched in: 8.0.4.1

Summary: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Details:
### Impact
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [scyoon](https://hackerone.com/scyoon).
GitHub Security Advisory: GHSA-cg4j-q9v8-6v38
Package: activesupport (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: >= 8.1.0.beta1, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited

Details:
### Impact
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [scyoon](https://hackerone.com/scyoon).
GitHub Security Advisory: GHSA-v55j-83pf-r9cq
Package: actionview (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 7.2.3.1
Patched in: 7.2.3.1

Summary: Rails has a possible XSS vulnerability in its Action View tag helpers

Details:
### Impact
When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [taise](https://hackerone.com/taise).
GitHub Security Advisory: GHSA-v55j-83pf-r9cq
Package: actionview (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.0.0.beta1, < 8.0.4.1
Patched in: 8.0.4.1

Summary: Rails has a possible XSS vulnerability in its Action View tag helpers

Details:
### Impact
When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [taise](https://hackerone.com/taise).
GitHub Security Advisory: GHSA-v55j-83pf-r9cq
Package: actionview (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.1.0.beta1, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails has a possible XSS vulnerability in its Action View tag helpers

Details:
### Impact
When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [taise](https://hackerone.com/taise).
GitHub Security Advisory: GHSA-pgm4-439c-5jp6
Package: actionpack (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 8.1.0, < 8.1.2.1
Patched in: 8.1.2.1

Summary: Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Details:
### Impact
The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases
The fixed releases are available at the normal locations.

### Credit
This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).
GitHub Security Advisory: GHSA-3m5v-4xp5-gjg2
Package: graphiti (RUBYGEMS)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-913: Improper Control of Dynamically-Managed Code Resources
Vulnerable versions: <= 1.10.1
Patched in: 1.10.2

Summary: Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names

Details:
### Summary

An arbitrary method execution vulnerability has been found which affects Graphiti's JSONAPI write functionality. An attacker can craft a malicious JSONAPI payload with arbitrary relationship names to invoke any public method on the underlying model instance, class or its associations.

### Impact

Any application exposing Graphiti write endpoints (create/update/delete) to untrusted users is affected. 

The `Graphiti::Util::ValidationResponse#all_valid?` method recursively calls `model.send(name)` using relationship names taken directly from user-supplied JSONAPI payloads, without validating them against the resource's configured sideloads. This allows an attacker to potentially run any public method on a given model instance, on the instance class or associated instances or classes, including destructive operations.

### Patches

This is patched in Graphiti **v1.10.2**. Users should upgrade as soon as possible.

### Workarounds

If upgrading to v1.10.2 is not immediately possible, consider one or more of the following mitigations:

- **Restrict write access**: Ensure Graphiti write endpoints (create/update/delete) are not accessible to untrusted users.
- **Authentication & authorisation**: Apply strong authentication and authorisation checks before any write operation is processed, for example use Rails strong parameters to ensure only valid parameters are processed.
GitHub Security Advisory: GHSA-f27w-vcwj-c954
Package: bcrypt (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: <= 3.1.21
Patched in: 3.1.22

Summary: bcrypt-ruby has an Integer Overflow that Causes Zero Key-Strengthening Iterations at Cost=31 on JRuby

Details:
### Impact

An integer overflow in the Java BCrypt implementation for JRuby can cause zero iterations in the strengthening loop.  Impacted applications must be setting the cost to 31 to see this happen.

The JRuby implementation of bcrypt-ruby (`BCrypt.java`) computes the key-strengthening round count as a signed 32-bit integer. When `cost=31` (the maximum allowed by the gem), signed integer overflow causes the round count to become negative, and the strengthening loop executes **zero iterations**. This collapses bcrypt from 2^31 rounds of exponential key-strengthening to effectively constant-time computation — only the initial EksBlowfish key setup and final 64x encryption phase remain.

The resulting hash looks valid (`$2a$31$...`) and verifies correctly via `checkpw`, making the weakness invisible to the application. This issue is triggered only when cost=31 is used or when verifying a `$2a$31$` hash.

### Patches

This problem has been fixed in version 3.1.22

### Workarounds

Set the cost to something less than 31.
GitHub Security Advisory: GHSA-3m6g-2423-7cp3
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: >= 2.14.0, < 2.15.2.1
Patched in: 2.15.2.1

Summary: Ruby JSON has a format string injection vulnerability

Details:
### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. 

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.
GitHub Security Advisory: GHSA-3m6g-2423-7cp3
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: >= 2.16.0, < 2.17.1.2
Patched in: 2.17.1.2

Summary: Ruby JSON has a format string injection vulnerability

Details:
### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. 

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.
GitHub Security Advisory: GHSA-3m6g-2423-7cp3
Package: json (RUBYGEMS)
Severity: HIGH (CVSS 0.0)
CWE: CWE-134: Use of Externally-Controlled Format String
Vulnerable versions: >= 2.18.0, < 2.19.2
Patched in: 2.19.2

Summary: Ruby JSON has a format string injection vulnerability

Details:
### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. 

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.
GitHub Security Advisory: GHSA-762r-27w2-q22j
Package: avo (RUBYGEMS)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 3.30.2
Patched in: 3.30.3

Summary: Avo has a XSS vulnerability on `return_to` param

Details:
## Description

A reflected cross-site scripting (XSS) vulnerability exists in the `return_to` query parameter used in the avo interface.

An attacker can craft a malicious URL that injects arbitrary JavaScript, which is executed when he clicks a dynamically generated navigation button.

## Impact

This vulnerability may allow execution of arbitrary JavaScript in the context of the application.

Impact varies depending on deployment:
- In unauthenticated setups: exploitable via crafted links sent to users
- In authenticated setups: limited to authenticated users and requires interaction
GitHub Security Advisory: GHSA-46fp-8f5p-pf2m
Package: loofah (RUBYGEMS)
Severity: LOW (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.25.0
Patched in: 2.25.1

Summary: Improper detection of disallowed URIs by Loofah `allowed_uri?`

Details:
## Summary

`Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split by HTML entity-encoded control characters such as `&#13;` (carriage return), `&#10;` (line feed), or `&#9;` (tab).

## Details

The `allowed_uri?` method strips literal control characters before decoding HTML entities. Payloads like `java&#13;script:alert(1)` survive the control character strip, then `&#13;` is decoded to a carriage return, producing `java\rscript:alert(1)`.

Note that the Loofah sanitizer's default `sanitize()` path is **not affected** because Nokogiri decodes HTML entities during parsing before Loofah evaluates the URI protocol. This issue only affects direct callers of the `allowed_uri?` string-level helper when passing HTML-encoded strings.

## Impact

Applications that call `Loofah::HTML5::Scrub.allowed_uri?` to validate user-controlled URLs and then render approved URLs into `href` or other browser-interpreted URI attributes may be vulnerable to cross-site scripting (XSS).

This only affects Loofah `2.25.0`.

## Mitigation

Upgrade to Loofah >= `2.25.1`.

## Credit

Responsibly reported by HackOne user `@smlee`.
GitHub Security Advisory: GHSA-fwj4-6wgp-mpxm
Package: katello (RUBYGEMS)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Vulnerable versions: < 4.19.1
Patched in: 4.19.1

Summary: Katello: Denial of Service and potential information disclosure via SQL injection

Details:
A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database.
GitHub Security Advisory: GHSA-57hq-95w6-v4fc
Package: devise (RUBYGEMS)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: <= 5.0.2
Patched in: 5.0.3

Summary: Devise has a confirmable "change email" race condition permits user to confirm email they have no access to

Details:
### Impact

A race condition in Devise's Confirmable module allows an attacker to confirm an email address they do not own. This affects any Devise application using the `reconfirmable` option (the default when using Confirmable with email changes).

By sending two concurrent email change requests, an attacker can desynchronize the `confirmation_token` and `unconfirmed_email` fields. The confirmation token is sent to an email the attacker controls, but the `unconfirmed_email` in the database points to a victim's email address. When the attacker uses the token, the victim's email is confirmed on the attacker's account.

### Patches

This is patched in Devise **v5.0.3**. Users should upgrade as soon as possible.

### Workarounds

Applications can override this specific method from Devise models to force `unconfirmed_email` to be persisted when unchanged: (assuming your model is `User`)

```ruby
class User < ApplicationRecord
  protected

  def postpone_email_change_until_confirmation_and_regenerate_confirmation_token
    unconfirmed_email_will_change!
    super
  end
end
```

Note: Mongoid does not seem to respect that `will_change!` should force the attribute to be persisted, even if it did not really change, so you might have to implement a workaround similar to Devise by setting `changed_attributes["unconfirmed_email"] = nil` as well.