1 GHSA/SYNC; 1 modified; 4 brand new advisories

gems/datadog/CVE-2026-50276.yml

@@ -0,0 +1,42 @@
+---
+gem: datadog
+cve: 2026-50276
+ghsa: p5f6-rccc-jv98
+url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
+title: dd-trace-rb - Improper parsing of W3C baggage headers may lead to DoS
+date: 2026-07-15
+description: |
+  ### Impact
+
+  Datadog tracing libraries that implement W3C baggage propagation parse
+  incoming baggage HTTP headers without enforcing item-count or byte-size
+  limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64)
+  and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only
+  to baggage injection, not extraction. A remote, unauthenticated attacker
+  can send a request whose baggage header contains an arbitrarily large
+  number of comma-separated key-value pairs (or a single very large value).
+  The tracer allocates a hash-map entry for each pair on every request,
+  causing unbounded CPU and memory consumption and enabling a remote
+  Denial of Service against any HTTP service that has the baggage
+  propagation style enabled.
+  The baggage propagation style is enabled by default in most affected
+  tracers, so any internet-facing service that has been instrumented
+  with an affected tracer version is exposed unless the propagation
+  style has been explicitly narrowed.
+cvss_v3: 7.5
+patched_versions:
+  - ">= 2.32.0"
+related:
+  url:
+    - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-50276
+    - https://rubygems.org/gems/datadog/versions/2.32.0
+    - https://github.com/DataDog/dd-trace-rb/blob/master/CHANGELOG.md#2320---2026-05-08
+    - https://advisories.gitlab.com/gem/datadog/CVE-2026-50276
+    - https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
+    - https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j
+    - https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98
+    - https://github.com/advisories/GHSA-p5f6-rccc-jv98
+notes: |
+  - cvss_v3 value comes from GHSA.
+  - No CVE.

gems/erb/CVE-2026-41316.yml

@@ -26,6 +26,7 @@ patched_versions:
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41316
+    - https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released
     - https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released
     - https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
     - https://github.com/ruby/erb/blob/master/NEWS.md

gems/loofah/GHSA-5qhf-9phg-95m2.yml

@@ -0,0 +1,45 @@
+---
+gem: loofah
+ghsa: 5qhf-9phg-95m2
+url: https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
+title: Loofah `allowed_uri?` does not detect `javascript:` URIs
+  split by numeric character references without semicolons
+date: 2026-07-15
+description: |
+  ## Summary
+
+  Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
+  or vbscript: URIs when the scheme is split by a numeric character
+  reference that has no trailing semicolon. A browser decodes such
+  references and resolves the URL to an executable javascript: scheme,
+  while allowed_uri? reports it safe.
+
+  This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
+  numeric character references with a trailing ; (	, 
, 
)
+  but did not cover the forms without semicolons.
+
+  ## Impact
+
+  Callers that validate a user-controlled URL with
+  Loofah::HTML5::Scrub.allowed_uri? and then render the approved value
+  into an href or other browser-interpreted URI attribute may be
+  vulnerable to cross-site scripting (XSS). This includes applications
+  that call allowed_uri? directly, as well as higher-level features
+  built on top of it, such as Action Text 8.2's markdown link validation.
+
+  ## Credit
+
+  Responsibly reported by GitHub user @MoonFuji.
+unaffected_versions:
+  - "< 2.25.0"
+patched_versions:
+  - ">= 2.25.2"
+related:
+  url:
+    - https://rubygems.org/gems/loofah/versions/2.25.2
+    - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
+    - https://github.com/advisories/GHSA-46fp-8f5p-pf2m
+    - https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
+notes: |
+  - "Low" severity from GHSA
+  - No CVE.

gems/loofah/GHSA-8whx-365g-h9vv.yml

@@ -0,0 +1,30 @@
+---
+gem: loofah
+ghsa: 8whx-365g-h9vv
+url: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
+title: Loofah `allowed_uri?` does not detect `javascript:` URIs
+  split by named whitespace character references
+date: 2026-07-15
+description: |
+  ## Summary
+
+  Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
+  URIs when the scheme is split or prefixed by the HTML5 named character
+  references 	 (tab) or 
 (line feed).
+
+  This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
+  the equivalent numeric character references (	, 
, 
) but
+  did not cover the named forms.
+unaffected_versions:
+  - "< 2.25.0"
+patched_versions:
+  - ">= 2.25.2"
+related:
+  url:
+    - https://rubygems.org/gems/loofah/versions/2.25.2
+    - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
+    - https://github.com/advisories/GHSA-46fp-8f5p-pf2m
+    - https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
+notes: |
+  - "Low" severity from GHSA
+  - No CVE.

gems/loofah/GHSA-9wjq-cp2p-hrgf.yml

@@ -0,0 +1,42 @@
+---
+gem: loofah
+ghsa: 9wjq-cp2p-hrgf
+url: https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
+title: SVG `href` attribute bypasses local-reference restriction in Loofah
+date: 2026-07-15
+description: |
+  ## Summary
+
+  Loofah's HTML5 sanitizer restricted only the xlink:href attribute on
+  certain SVG elements to local, same-document references. Browsers
+  also accept a plain href attribute as an alternative to the deprecated
+  xlink:href per the SVG 2 spec, but Loofah did not apply the same
+  restriction to it, allowing those elements to reference arbitrary
+  external documents.
+
+  ## Impact
+
+  SVG <use> can load and render external SVG content by reference. If
+  the referenced external SVG is same-origin and contains scripts or
+  other dangerous content, it could execute in the context of the
+  sanitized document. <feImage> can load external images, which can be
+  used for tracking. Modern browsers restrict cross-origin <use>
+  fetches, which limits but does not eliminate the risk.
+
+  Applications that sanitize user-supplied SVG (directly, or as part
+  of HTML) with Loofah's default allowlist are affected.
+
+  ## Credit
+
+  Found by the maintainer, Mike Dalessio, during a security audit.
+cvss_v3: 4.7
+patched_versions:
+  - ">= 2.25.2"
+related:
+  url:
+    - https://rubygems.org/gems/loofah/versions/2.25.2
+    - https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
+    - https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
+notes: |
+  - cvss_v3 value from GHSA
+  - No CVE.

gems/rails-html-sanitizer/GHSA-cj75-f6xr-r4g7.yml

@@ -0,0 +1,31 @@
+---
+gem: rails-html-sanitizer
+framework: rails
+ghsa: cj75-f6xr-r4g7
+url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
+title: Possible XSS vulnerability with certain configurations of
+  rails-html-sanitizer
+date: 2026-07-15
+description: |
+  ## Summary
+
+  There is a possible cross-site scripting vulnerability in
+  rails-html-sanitizer when the sanitizer is configured to allow an
+  SVG reference element such as <use>.
+  See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference
+  logic rails-html-sanitizer mirrors.
+unaffected_versions:
+  - "< 1.0.3"
+patched_versions:
+  - ">= 1.7.1"
+related:
+  url:
+    - https://rubygems.org/gems/rails-html-sanitizer/versions/1.7.1
+    - https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md#v171--2026-07-15
+    - https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586
+    - https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359#post_1
+    - https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
+    - https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
+notes: |
+  - "Moderate" severity in GHSA
+  - No CVE.