diff --git a/gems/datadog/CVE-2026-50276.yml b/gems/datadog/CVE-2026-50276.yml new file mode 100644 index 0000000000..c1ddef9c29 --- /dev/null +++ b/gems/datadog/CVE-2026-50276.yml @@ -0,0 +1,42 @@ +--- +gem: datadog +cve: 2026-50276 +ghsa: p5f6-rccc-jv98 +url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276 +title: dd-trace-rb - Improper parsing of W3C baggage headers may lead to DoS +date: 2026-07-15 +description: | + ### Impact + + Datadog tracing libraries that implement W3C baggage propagation parse + incoming baggage HTTP headers without enforcing item-count or byte-size + limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) + and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only + to baggage injection, not extraction. A remote, unauthenticated attacker + can send a request whose baggage header contains an arbitrarily large + number of comma-separated key-value pairs (or a single very large value). + The tracer allocates a hash-map entry for each pair on every request, + causing unbounded CPU and memory consumption and enabling a remote + Denial of Service against any HTTP service that has the baggage + propagation style enabled. + The baggage propagation style is enabled by default in most affected + tracers, so any internet-facing service that has been instrumented + with an affected tracer version is exposed unless the propagation + style has been explicitly narrowed. +cvss_v3: 7.5 +patched_versions: + - ">= 2.32.0" +related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276 + - https://nvd.nist.gov/vuln/detail/CVE-2026-50276 + - https://rubygems.org/gems/datadog/versions/2.32.0 + - https://github.com/DataDog/dd-trace-rb/blob/master/CHANGELOG.md#2320---2026-05-08 + - https://advisories.gitlab.com/gem/datadog/CVE-2026-50276 + - https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475 + - https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j + - https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98 + - https://github.com/advisories/GHSA-p5f6-rccc-jv98 +notes: | + - cvss_v3 value comes from GHSA. + - No CVE. diff --git a/gems/erb/CVE-2026-41316.yml b/gems/erb/CVE-2026-41316.yml index a8f462d88b..2b77b4a548 100644 --- a/gems/erb/CVE-2026-41316.yml +++ b/gems/erb/CVE-2026-41316.yml @@ -26,6 +26,7 @@ patched_versions: related: url: - https://nvd.nist.gov/vuln/detail/CVE-2026-41316 + - https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released - https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316 - https://github.com/ruby/erb/blob/master/NEWS.md diff --git a/gems/loofah/GHSA-5qhf-9phg-95m2.yml b/gems/loofah/GHSA-5qhf-9phg-95m2.yml new file mode 100644 index 0000000000..516be8b387 --- /dev/null +++ b/gems/loofah/GHSA-5qhf-9phg-95m2.yml @@ -0,0 +1,45 @@ +--- +gem: loofah +ghsa: 5qhf-9phg-95m2 +url: https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 +title: Loofah `allowed_uri?` does not detect `javascript:` URIs + split by numeric character references without semicolons +date: 2026-07-15 +description: | + ## Summary + + Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: + or vbscript: URIs when the scheme is split by a numeric character + reference that has no trailing semicolon. A browser decodes such + references and resolves the URL to an executable javascript: scheme, + while allowed_uri? reports it safe. + + This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled + numeric character references with a trailing ; ( , , ) + but did not cover the forms without semicolons. + + ## Impact + + Callers that validate a user-controlled URL with + Loofah::HTML5::Scrub.allowed_uri? and then render the approved value + into an href or other browser-interpreted URI attribute may be + vulnerable to cross-site scripting (XSS). This includes applications + that call allowed_uri? directly, as well as higher-level features + built on top of it, such as Action Text 8.2's markdown link validation. + + ## Credit + + Responsibly reported by GitHub user @MoonFuji. +unaffected_versions: + - "< 2.25.0" +patched_versions: + - ">= 2.25.2" +related: + url: + - https://rubygems.org/gems/loofah/versions/2.25.2 + - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15 + - https://github.com/advisories/GHSA-46fp-8f5p-pf2m + - https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2 +notes: | + - "Low" severity from GHSA + - No CVE. diff --git a/gems/loofah/GHSA-8whx-365g-h9vv.yml b/gems/loofah/GHSA-8whx-365g-h9vv.yml new file mode 100644 index 0000000000..d9039de406 --- /dev/null +++ b/gems/loofah/GHSA-8whx-365g-h9vv.yml @@ -0,0 +1,30 @@ +--- +gem: loofah +ghsa: 8whx-365g-h9vv +url: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv +title: Loofah `allowed_uri?` does not detect `javascript:` URIs + split by named whitespace character references +date: 2026-07-15 +description: | + ## Summary + + Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript: + URIs when the scheme is split or prefixed by the HTML5 named character + references (tab) or (line feed). + + This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled + the equivalent numeric character references ( , , ) but + did not cover the named forms. +unaffected_versions: + - "< 2.25.0" +patched_versions: + - ">= 2.25.2" +related: + url: + - https://rubygems.org/gems/loofah/versions/2.25.2 + - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15 + - https://github.com/advisories/GHSA-46fp-8f5p-pf2m + - https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv +notes: | + - "Low" severity from GHSA + - No CVE. diff --git a/gems/loofah/GHSA-9wjq-cp2p-hrgf.yml b/gems/loofah/GHSA-9wjq-cp2p-hrgf.yml new file mode 100644 index 0000000000..09cecd4dc4 --- /dev/null +++ b/gems/loofah/GHSA-9wjq-cp2p-hrgf.yml @@ -0,0 +1,42 @@ +--- +gem: loofah +ghsa: 9wjq-cp2p-hrgf +url: https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf +title: SVG `href` attribute bypasses local-reference restriction in Loofah +date: 2026-07-15 +description: | + ## Summary + + Loofah's HTML5 sanitizer restricted only the xlink:href attribute on + certain SVG elements to local, same-document references. Browsers + also accept a plain href attribute as an alternative to the deprecated + xlink:href per the SVG 2 spec, but Loofah did not apply the same + restriction to it, allowing those elements to reference arbitrary + external documents. + + ## Impact + + SVG can load and render external SVG content by reference. If + the referenced external SVG is same-origin and contains scripts or + other dangerous content, it could execute in the context of the + sanitized document. can load external images, which can be + used for tracking. Modern browsers restrict cross-origin + fetches, which limits but does not eliminate the risk. + + Applications that sanitize user-supplied SVG (directly, or as part + of HTML) with Loofah's default allowlist are affected. + + ## Credit + + Found by the maintainer, Mike Dalessio, during a security audit. +cvss_v3: 4.7 +patched_versions: + - ">= 2.25.2" +related: + url: + - https://rubygems.org/gems/loofah/versions/2.25.2 + - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15 + - https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf +notes: | + - cvss_v3 value from GHSA + - No CVE. diff --git a/gems/rails-html-sanitizer/GHSA-cj75-f6xr-r4g7.yml b/gems/rails-html-sanitizer/GHSA-cj75-f6xr-r4g7.yml new file mode 100644 index 0000000000..de9d703b92 --- /dev/null +++ b/gems/rails-html-sanitizer/GHSA-cj75-f6xr-r4g7.yml @@ -0,0 +1,31 @@ +--- +gem: rails-html-sanitizer +framework: rails +ghsa: cj75-f6xr-r4g7 +url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7 +title: Possible XSS vulnerability with certain configurations of + rails-html-sanitizer +date: 2026-07-15 +description: | + ## Summary + + There is a possible cross-site scripting vulnerability in + rails-html-sanitizer when the sanitizer is configured to allow an + SVG reference element such as . + See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference + logic rails-html-sanitizer mirrors. +unaffected_versions: + - "< 1.0.3" +patched_versions: + - ">= 1.7.1" +related: + url: + - https://rubygems.org/gems/rails-html-sanitizer/versions/1.7.1 + - https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md#v171--2026-07-15 + - https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586 + - https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359#post_1 + - https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf + - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7 +notes: | + - "Moderate" severity in GHSA + - No CVE.