diff --git a/gems/agoo/CVE-2020-7670.yml b/gems/agoo/CVE-2020-7670.yml deleted file mode 100644 index 46c855db99..0000000000 --- a/gems/agoo/CVE-2020-7670.yml +++ /dev/null @@ -1,20 +0,0 @@ ---- -gem: agoo -cve: 2020-7670 -ghsa: h385-52j6-9984 -url: https://github.com/ohler55/agoo/issues/88 -date: 2020-10-20 -title: HTTP Request Smuggling in Agoo -description: | - agoo through 2.12.3 allows request smuggling attacks where agoo is used - as a backend and a frontend proxy also being vulnerable. It is possible to conduct - HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, - invalid Transfer Encoding headers were found to be parsed as valid which could be - leveraged for TE:CL smuggling attacks. -cvss_v3: 7.5 -patched_versions: - - ">= 2.13.0" - -related: - url: - - https://github.com/ohler55/agoo/commit/23d03535cf7b50d679a60a953a0cae9519a4a130 diff --git a/gems/alchemy_cms/CVE-2018-18307.yml b/gems/alchemy_cms/CVE-2018-18307.yml deleted file mode 100644 index 8a58df8a40..0000000000 --- a/gems/alchemy_cms/CVE-2018-18307.yml +++ /dev/null @@ -1,25 +0,0 @@ ---- -gem: alchemy_cms -cve: 2018-18307 -ghsa: 7mj4-2984-955f -url: https://nvd.nist.gov/vuln/detail/CVE-2018-18307 -title: AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field -date: 2022-05-14 -description: | - A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS - via the /admin/pictures image filename field. -cvss_v3: 5.9 -unaffected_versions: - - "< 4.1.0" -patched_versions: - - ">= 7.4.10" -related: - url: - - https://nvd.nist.gov/vuln/detail/CVE-2018-18307 - - http://packetstormsecurity.com/files/149787/Alchemy-CMS-4.1-Stable-Cross-Site-Scripting.html - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/base_controller.rb#L15 - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/pictures_controller.rb#L5 - - https://github.com/AlchemyCMS/alchemy_cms/blob/4.1-stable/app/controllers/alchemy/admin/resources_controller.rb#L21 - - https://github.com/AlchemyCMS/alchemy_cms/pull/3375 - - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v7.4.10 - - https://github.com/advisories/GHSA-7mj4-2984-955f diff --git a/gems/bootstrap/CVE-2024-6531.yml b/gems/bootstrap/CVE-2024-6531.yml deleted file mode 100644 index 8ff6b99c6c..0000000000 --- a/gems/bootstrap/CVE-2024-6531.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -gem: bootstrap -cve: 2024-6531 -ghsa: vc8w-jr9v-vj7f -url: https://github.com/advisories/GHSA-vc8w-jr9v-vj7f -title: Bootstrap Cross-Site Scripting (XSS) vulnerability -date: 2024-07-11 -description: | - A vulnerability has been identified in Bootstrap that exposes users - to Cross-Site Scripting (XSS) attacks. The issue is present in the - carousel component, where the data-slide and data-slide-to attributes - can be exploited through the href attribute of an tag due to - inadequate sanitization. This vulnerability could potentially enable - attackers to execute arbitrary JavaScript within the victim's browser. -cvss_v3: 6.4 -unaffected_versions: - - "< 4.0.0" -patched_versions: - - "> 4.6.2" -related: - url: - - https://nvd.nist.gov/vuln/detail/CVE-2024-6531 - - https://www.herodevs.com/vulnerability-directory/cve-2024-6531 - - https://github.com/advisories/GHSA-vc8w-jr9v-vj7f diff --git a/gems/fat_free_crm/CVE-2019-10226.yml b/gems/fat_free_crm/CVE-2019-10226.yml deleted file mode 100644 index 56c21a1cb5..0000000000 --- a/gems/fat_free_crm/CVE-2019-10226.yml +++ /dev/null @@ -1,11 +0,0 @@ ---- -gem: fat_free_crm -cve: 2019-10226 -ghsa: gmg5-r3c4-3fm9 -url: http://packetstormsecurity.com/files/152263/Fat-Free-CRM-0.19.0-HTML-Injection.html -title: Fat Free CRM Cross-site Scripting vulnerability -date: 2022-05-24 -description: | - HTML Injection has been discovered in the v0.19.0 version of the Fat - Free CRM product via an authenticated request to the /comments URI. -cvss_v3: 5.4 diff --git a/gems/jquery-rails/CVE-2020-23064.yml b/gems/jquery-rails/CVE-2020-23064.yml index 8fc0df7963..1c097b0075 100644 --- a/gems/jquery-rails/CVE-2020-23064.yml +++ b/gems/jquery-rails/CVE-2020-23064.yml @@ -26,4 +26,5 @@ related: - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#410 - https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440 + - https://github.com/advisories/GHSA-jpcq-cgw6-v4j6 - https://github.com/advisories/GHSA-257q-pv89-v3xv diff --git a/gems/prosemirror_to_html/GHSA-4249-gjr8-jpq3.yml b/gems/prosemirror_to_html/GHSA-4249-gjr8-jpq3.yml deleted file mode 100644 index 691b96dee3..0000000000 --- a/gems/prosemirror_to_html/GHSA-4249-gjr8-jpq3.yml +++ /dev/null @@ -1,75 +0,0 @@ ---- -gem: prosemirror_to_html -ghsa: 4249-gjr8-jpq3 -url: https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx -title: ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability - through unescaped HTML attribute values -date: 2025-11-13 -description: | - ### Impact - - The prosemirror_to_html gem is vulnerable to Cross-Site Scripting - (XSS) attacks through malicious HTML attribute values. While tag - content is properly escaped, attribute values are not, allowing - attackers to inject arbitrary JavaScript code. - - **Who is impacted:** - - - Any application using prosemirror_to_html to convert ProseMirror - documents to HTML - - Applications that process user-generated ProseMirror content are - at highest risk - - End users viewing the rendered HTML output could have malicious - JavaScript executed in their browsers - - **Attack vectors include:** - - - `href` attributes with `javascript:` protocol: - `` - - Event handlers: `
` - - `onerror` attributes on images: `` - - Other HTML attributes that can execute JavaScript - - ### Patches - - A fix is currently in development. Users should upgrade to version - **0.2.1** or later once released. The patch escapes all HTML attribute - values using `CGI.escapeHTML` to prevent injection attacks. - - ### Workarounds - - Until a patched version is available, users can implement one or - more of these mitigations: - - 1. **Sanitize output**: Pass the HTML output through a sanitization - library like [Sanitize](https://github.com/rgrove/sanitize) or - [Loofah](https://github.com/flavorjones/loofah): - - ```ruby - html = ProsemirrorToHtml.render(document) - safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED) - ``` - - 2. **Implement Content Security Policy (CSP)**: Add strict CSP - headers to prevent inline JavaScript execution: - ``` - Content-Security-Policy: default-src 'self'; script-src 'self' - ``` - - 3. **Input validation**: If possible, validate and sanitize - ProseMirror documents before conversion to prevent malicious - content from entering the system. - - ### References - - - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 - - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) -patched_versions: - - ">= 0.2.1" -related: - url: - - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx - - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8 - - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html - - https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249 - - https://github.com/advisories/GHSA-4249-gjr8-jpq3 diff --git a/gems/spree_auth_devise/CVE-2021-41275.yml b/gems/spree_auth_devise/CVE-2021-41275.yml index 550cdd743f..cb5b557f90 100644 --- a/gems/spree_auth_devise/CVE-2021-41275.yml +++ b/gems/spree_auth_devise/CVE-2021-41275.yml @@ -64,3 +64,7 @@ related: - 6mqr-q86q-6gwr url: - https://github.com/spree/spree_auth_devise/commit/adf6ed4cd94d66091776b5febd4ff3767362de63 + - https://github.com/advisories/GHSA-gpqc-4pp7-5954 + - https://github.com/advisories/GHSA-8xfw-5q82-3652 + - https://github.com/advisories/GHSA-6mqr-q86q-6gwr + - https://github.com/advisories/GHSA-26xx-m4q2-xhq8 diff --git a/gems/thor/CVE-2025-54314.yml b/gems/thor/CVE-2025-54314.yml deleted file mode 100644 index f6dcdcd0d0..0000000000 --- a/gems/thor/CVE-2025-54314.yml +++ /dev/null @@ -1,21 +0,0 @@ ---- -gem: thor -cve: 2025-54314 -ghsa: mqcp-p2hv-vw6x -url: https://github.com/advisories/GHSA-mqcp-p2hv-vw6x -title: Thor can construct an unsafe shell command from library input. -date: 2025-07-20 -description: | - Thor before 1.4.0 can construct an unsafe shell command - from library input. -cvss_v3: 2.8 -patched_versions: - - ">= 1.4.0" -related: - url: - - https://nvd.nist.gov/vuln/detail/CVE-2025-54314 - - https://github.com/rails/thor/releases/tag/v1.4.0 - - https://github.com/rails/thor/pull/897 - - https://github.com/rails/thor/commit/536b79036a0efb765c1899233412e7b1ca94abfa - - https://hackerone.com/reports/3260153 - - https://github.com/advisories/GHSA-mqcp-p2hv-vw6x diff --git a/lib/rad-ignores.sh b/lib/rad-ignores.sh index f52d3f0dc0..846afd0e72 100755 --- a/lib/rad-ignores.sh +++ b/lib/rad-ignores.sh @@ -134,6 +134,28 @@ rm -f gems/omniauth-saml/GHSA-cgp2-2cmh-pf7x.yml # - https://github.com/pglombardo/PasswordPusher/releases/tag/v1.48.1 # Release 1.48.1; Password Pusher Application; erb file code fix +#..................................................................... + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-h385-52j6-9984 +rm -f gems/agoo/CVE-2020-7670.yml + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-gmg5-r3c4-3fm9 +rm -f gems/fat_free_crm/CVE-2019-10226.yml + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-4249-gjr8-jpq3 +rm -f gems/prosemirror_to_html/GHSA-4249-gjr8-jpq3.yml + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-mqcp-p2hv-vw6x +rm -f gems/thor/CVE-2025-54314.yml + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-vc8w-jr9v-vj7f +# * (REJECTED) https://nvd.nist.gov/vuln/detail/CVE-2024-6531 +rm -f gems/bootstrap/CVE-2024-6531.yml + +# 7/23/2026: GHSA/WITHDRAWN: https://github.com/advisories/GHSA-7mj4-2984-955f +# * (DISPUTED) https://nvd.nist.gov/vuln/detail/CVE-2018-18307 +rm -f gems/alchemy_cms/CVE-2018-18307.yml + exit # AL>> QUESTION (ruby or jruby)?