Skip to content

Commit 7920e99

Browse files
flavorjonesRubySec CI
flavorjones
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@df41005 
1 parent afbc24a commit 7920e99

9 files changed

Lines changed: 354 additions & 0 deletions

‎advisories/_posts/2026-03-23-CVE-2026-33167.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33167 (actionpack): Rails has a possible XSS vulnerability in its
4+
Action Pack debug exceptions'
5+
comments: false
6+
categories:
7+
- actionpack
8+
- rails
9+
advisory:
10+
gem: actionpack
11+
framework: rails
12+
cve: 2026-33167
13+
ghsa: pgm4-439c-5jp6
14+
url: https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
15+
title: Rails has a possible XSS vulnerability in its Action Pack debug exceptions
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
The debug exceptions page does not properly escape exception messages.
20+
A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS.
21+
This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`),
22+
which is the default in development.
23+
24+
### Releases
25+
The fixed releases are available at the normal locations.
26+
unaffected_versions:
27+
- "< 8.1.0"
28+
patched_versions:
29+
- ">= 8.1.2.1"
30+
related:
31+
url:
32+
- https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
33+
- https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
34+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
35+
- https://github.com/advisories/GHSA-pgm4-439c-5jp6
36+
---

‎advisories/_posts/2026-03-23-CVE-2026-33168.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33168 (actionview): Rails has a possible XSS vulnerability in its
4+
Action View tag helpers'
5+
comments: false
6+
categories:
7+
- actionview
8+
- rails
9+
advisory:
10+
gem: actionview
11+
framework: rails
12+
cve: 2026-33168
13+
ghsa: v55j-83pf-r9cq
14+
url: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
15+
title: Rails has a possible XSS vulnerability in its Action View tag helpers
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
When a blank string is used as an HTML attribute name in Action View tag helpers,
20+
the attribute escaping is bypassed, producing malformed HTML.
21+
A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name,
22+
possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.
23+
24+
### Releases
25+
The fixed releases are available at the normal locations.
26+
patched_versions:
27+
- "~> 7.2.3, >= 7.2.3.1"
28+
- "~> 8.0.4, >= 8.0.4.1"
29+
- ">= 8.1.2.1"
30+
related:
31+
url:
32+
- https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
33+
- https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
34+
- https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
35+
- https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
36+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
37+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
38+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
39+
- https://github.com/advisories/GHSA-v55j-83pf-r9cq
40+
---

‎advisories/_posts/2026-03-23-CVE-2026-33169.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33169 (activesupport): Rails Active Support has a possible ReDoS
4+
vulnerability in number_to_delimited'
5+
comments: false
6+
categories:
7+
- activesupport
8+
- rails
9+
advisory:
10+
gem: activesupport
11+
framework: rails
12+
cve: 2026-33169
13+
ghsa: cg4j-q9v8-6v38
14+
url: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
15+
title: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters.
20+
This could produce quadratic time complexity on long digit strings.
21+
22+
### Releases
23+
The fixed releases are available at the normal locations.
24+
patched_versions:
25+
- "~> 7.2.3, >= 7.2.3.1"
26+
- "~> 8.0.4, >= 8.0.4.1"
27+
- ">= 8.1.2.1"
28+
related:
29+
url:
30+
- https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
31+
- https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
32+
- https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
33+
- https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
34+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
35+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
36+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
37+
- https://github.com/advisories/GHSA-cg4j-q9v8-6v38
38+
---

‎advisories/_posts/2026-03-23-CVE-2026-33170.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33170 (activesupport): Rails Active Support has a possible XSS vulnerability
4+
in SafeBuffer#%'
5+
comments: false
6+
categories:
7+
- activesupport
8+
- rails
9+
advisory:
10+
gem: activesupport
11+
framework: rails
12+
cve: 2026-33170
13+
ghsa: 89vf-4333-qx8v
14+
url: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
15+
title: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer.
20+
If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments,
21+
the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.
22+
23+
### Releases
24+
The fixed releases are available at the normal locations.
25+
patched_versions:
26+
- "~> 7.2.3, >= 7.2.3.1"
27+
- "~> 8.0.4, >= 8.0.4.1"
28+
- ">= 8.1.2.1"
29+
related:
30+
url:
31+
- https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
32+
- https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7
33+
- https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
34+
- https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
35+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
36+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
37+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
38+
- https://github.com/advisories/GHSA-89vf-4333-qx8v
39+
---

‎advisories/_posts/2026-03-23-CVE-2026-33173.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33173 (activestorage): Rails Active Storage has possible content
4+
type bypass via metadata in direct uploads'
5+
comments: false
6+
categories:
7+
- activestorage
8+
- rails
9+
advisory:
10+
gem: activestorage
11+
framework: rails
12+
cve: 2026-33173
13+
ghsa: qcfx-2mfw-w4cg
14+
url: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
15+
title: Rails Active Storage has possible content type bypass via metadata in direct
16+
uploads
17+
date: 2026-03-23
18+
description: |-
19+
### Impact
20+
Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob.
21+
Because internal flags like `identified` and `analyzed` are stored in the same metadata hash,
22+
a malicious direct-upload client could set these flags.
23+
24+
### Releases
25+
The fixed releases are available at the normal locations.
26+
patched_versions:
27+
- "~> 7.2.3, >= 7.2.3.1"
28+
- "~> 8.0.4, >= 8.0.4.1"
29+
- ">= 8.1.2.1"
30+
related:
31+
url:
32+
- https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
33+
- https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
34+
- https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
35+
- https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
36+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
37+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
38+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
39+
- https://github.com/advisories/GHSA-qcfx-2mfw-w4cg
40+
---

‎advisories/_posts/2026-03-23-CVE-2026-33174.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33174 (activestorage): Rails Active Storage has a possible DoS vulnerability
4+
when in proxy mode via Range requests'
5+
comments: false
6+
categories:
7+
- activestorage
8+
- rails
9+
advisory:
10+
gem: activestorage
11+
framework: rails
12+
cve: 2026-33174
13+
ghsa: r46p-8f7g-vvvg
14+
url: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
15+
title: Rails Active Storage has a possible DoS vulnerability when in proxy mode
16+
via Range requests
17+
date: 2026-03-23
18+
description: |-
19+
### Impact
20+
When serving files through Active Storage's `Blobs::ProxyController`,
21+
the controller loads the entire requested byte range into memory before sending it.
22+
A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server
23+
to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.
24+
25+
### Releases
26+
The fixed releases are available at the normal locations.
27+
patched_versions:
28+
- "~> 7.2.3, >= 7.2.3.1"
29+
- "~> 8.0.4, >= 8.0.4.1"
30+
- ">= 8.1.2.1"
31+
related:
32+
url:
33+
- https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
34+
- https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
35+
- https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
36+
- https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
37+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
38+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
39+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
40+
- https://github.com/advisories/GHSA-r46p-8f7g-vvvg
41+
---

‎advisories/_posts/2026-03-23-CVE-2026-33176.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33176 (activesupport): Rails Active Support has a possible DoS vulnerability
4+
in its number helpers'
5+
comments: false
6+
categories:
7+
- activesupport
8+
- rails
9+
advisory:
10+
gem: activesupport
11+
framework: rails
12+
cve: 2026-33176
13+
ghsa: 2j26-frm8-cmj9
14+
url: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
15+
title: Rails Active Support has a possible DoS vulnerability in its number helpers
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`),
20+
which when converted to a string could be expanded into extremely large decimal representations.
21+
This can cause excessive memory allocation and CPU consumption when the expanded number is formatted,
22+
possibly resulting in a DoS vulnerability.
23+
24+
### Releases
25+
The fixed releases are available at the normal locations.
26+
patched_versions:
27+
- "~> 7.2.3, >= 7.2.3.1"
28+
- "~> 8.0.4, >= 8.0.4.1"
29+
- ">= 8.1.2.1"
30+
related:
31+
url:
32+
- https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
33+
- https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
34+
- https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
35+
- https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
36+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
37+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
38+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
39+
- https://github.com/advisories/GHSA-2j26-frm8-cmj9
40+
---

‎advisories/_posts/2026-03-23-CVE-2026-33195.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33195 (activestorage): Rails Active Storage has possible Path Traversal
4+
in DiskService'
5+
comments: false
6+
categories:
7+
- activestorage
8+
- rails
9+
advisory:
10+
gem: activestorage
11+
framework: rails
12+
cve: 2026-33195
13+
ghsa: 9xrj-h377-fr87
14+
url: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
15+
title: Rails Active Storage has possible Path Traversal in DiskService
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
Active Storage's `DiskService#path_for` does not validate that the
20+
resolved filesystem path remains within the storage root directory.
21+
If a blob key containing path traversal sequences (e.g. `../`) is used,
22+
it could allow reading, writing, or deleting arbitrary files on the server.
23+
Blob keys are expected to be trusted strings,
24+
but some applications could be passing user input as keys and would be affected.
25+
26+
### Releases
27+
The fixed releases are available at the normal locations.
28+
patched_versions:
29+
- "~> 7.2.3, >= 7.2.3.1"
30+
- "~> 8.0.4, >= 8.0.4.1"
31+
- ">= 8.1.2.1"
32+
related:
33+
url:
34+
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
35+
- https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
36+
- https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
37+
- https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
38+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
39+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
40+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
41+
- https://github.com/advisories/GHSA-9xrj-h377-fr87
42+
---

‎advisories/_posts/2026-03-23-CVE-2026-33202.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-33202 (activestorage): Rails Active Storage has possible glob injection
4+
in its DiskService'
5+
comments: false
6+
categories:
7+
- activestorage
8+
- rails
9+
advisory:
10+
gem: activestorage
11+
framework: rails
12+
cve: 2026-33202
13+
ghsa: 73f9-jhhh-hr5m
14+
url: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
15+
title: Rails Active Storage has possible glob injection in its DiskService
16+
date: 2026-03-23
17+
description: |-
18+
### Impact
19+
Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters.
20+
If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters,
21+
it may be possible to delete unintended files from the storage directory.
22+
23+
### Releases
24+
The fixed releases are available at the normal locations.
25+
patched_versions:
26+
- "~> 7.2.3, >= 7.2.3.1"
27+
- "~> 8.0.4, >= 8.0.4.1"
28+
- ">= 8.1.2.1"
29+
related:
30+
url:
31+
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
32+
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
33+
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
34+
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
35+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
36+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
37+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
38+
---

0 commit comments

Comments
 (0)