Skip to content

Commit 187e2fe

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-89vf-4333-qx8v GHSA-cg4j-q9v8-6v38 GHSA-qcfx-2mfw-w4cg
1 parent 0ad1819 commit 187e2fe

3 files changed

Lines changed: 358 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-89vf-4333-qx8v/GHSA-89vf-4333-qx8v.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-89vf-4333-qx8v",
4+
"modified": "2026-03-23T20:53:28Z",
5+
"published": "2026-03-23T20:53:28Z",
6+
"aliases": [
7+
"CVE-2026-33170"
8+
],
9+
"summary": "Rails Active Support has a possible XSS vulnerability in SafeBuffer#%",
10+
"details": "### Impact\n`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer. If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments, the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.\n\n### Releases\nThe fixed releases are available at the normal locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "activesupport"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.1.0.beta1"
29+
},
30+
{
31+
"fixed": "8.1.2.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "activesupport"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0.beta1"
48+
},
49+
{
50+
"fixed": "8.0.4.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "activesupport"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "7.2.3.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/rails/rails"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-79"
113+
],
114+
"severity": "MODERATE",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2026-03-23T20:53:28Z",
117+
"nvd_published_at": null
118+
}
119+
}

‎advisories/github-reviewed/2026/03/GHSA-cg4j-q9v8-6v38/GHSA-cg4j-q9v8-6v38.json‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cg4j-q9v8-6v38",
4+
"modified": "2026-03-23T20:52:40Z",
5+
"published": "2026-03-23T20:52:40Z",
6+
"aliases": [
7+
"CVE-2026-33169"
8+
],
9+
"summary": "Rails Active Support has a possible ReDoS vulnerability in number_to_delimited",
10+
"details": "### Impact\n`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters. This could produce quadratic time complexity on long digit strings.\n\n### Releases\nThe fixed releases are available at the normal locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "activesupport"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.1.0.beta1"
29+
},
30+
{
31+
"fixed": "8.1.2.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "activesupport"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0.beta1"
48+
},
49+
{
50+
"fixed": "8.0.4.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "activesupport"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "7.2.3.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/rails/rails"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-1333",
113+
"CWE-400"
114+
],
115+
"severity": "MODERATE",
116+
"github_reviewed": true,
117+
"github_reviewed_at": "2026-03-23T20:52:40Z",
118+
"nvd_published_at": null
119+
}
120+
}

‎advisories/github-reviewed/2026/03/GHSA-qcfx-2mfw-w4cg/GHSA-qcfx-2mfw-w4cg.json‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qcfx-2mfw-w4cg",
4+
"modified": "2026-03-23T20:54:16Z",
5+
"published": "2026-03-23T20:54:16Z",
6+
"aliases": [
7+
"CVE-2026-33173"
8+
],
9+
"summary": "Rails Active Storage has possible content type bypass via metadata in direct uploads",
10+
"details": "### Impact\nActive Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob. Because internal flags like `identified` and `analyzed` are stored in the same metadata hash, a malicious direct-upload client could set these flags.\n\n### Releases\nThe fixed releases are available at the normal locations.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "RubyGems",
21+
"name": "activestorage"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "8.1.0.beta1"
29+
},
30+
{
31+
"fixed": "8.1.2.1"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "RubyGems",
40+
"name": "activestorage"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "8.0.0.beta1"
48+
},
49+
{
50+
"fixed": "8.0.4.1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "RubyGems",
59+
"name": "activestorage"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "0"
67+
},
68+
{
69+
"fixed": "7.2.3.1"
70+
}
71+
]
72+
}
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"type": "WEB",
79+
"url": "https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg"
80+
},
81+
{
82+
"type": "WEB",
83+
"url": "https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53"
84+
},
85+
{
86+
"type": "WEB",
87+
"url": "https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e"
88+
},
89+
{
90+
"type": "WEB",
91+
"url": "https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0"
92+
},
93+
{
94+
"type": "PACKAGE",
95+
"url": "https://github.com/rails/rails"
96+
},
97+
{
98+
"type": "WEB",
99+
"url": "https://github.com/rails/rails/releases/tag/v7.2.3.1"
100+
},
101+
{
102+
"type": "WEB",
103+
"url": "https://github.com/rails/rails/releases/tag/v8.0.4.1"
104+
},
105+
{
106+
"type": "WEB",
107+
"url": "https://github.com/rails/rails/releases/tag/v8.1.2.1"
108+
}
109+
],
110+
"database_specific": {
111+
"cwe_ids": [
112+
"CWE-925"
113+
],
114+
"severity": "MODERATE",
115+
"github_reviewed": true,
116+
"github_reviewed_at": "2026-03-23T20:54:16Z",
117+
"nvd_published_at": null
118+
}
119+
}

0 commit comments

Comments
 (0)