Skip to content

Commit 03c7702

Browse files
jamgregoryjamgregory
committed
Added details of new Rails vulnerabilities
1 parent b1e3c15 commit 03c7702

File tree

9 files changed

+273
-0
lines changed

9 files changed

+273
-0
lines changed

‎gems/actionpack/CVE-2026-33167.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
gem: actionpack
3+
framework: rails
4+
cve: 2026-33167
5+
ghsa: pgm4-439c-5jp6
6+
url: https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
7+
title: Rails has a possible XSS vulnerability in its Action Pack debug exceptions
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
The debug exceptions page does not properly escape exception messages.
12+
A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS.
13+
This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`),
14+
which is the default in development.
15+
16+
### Releases
17+
The fixed releases are available at the normal locations.
18+
unaffected_versions:
19+
- "< 8.1.0"
20+
patched_versions:
21+
- ">= 8.1.2.1"
22+
related:
23+
url:
24+
- https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6
25+
- https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0
26+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
27+
- https://github.com/advisories/GHSA-pgm4-439c-5jp6

‎gems/actionview/CVE-2026-33168.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: actionview
3+
framework: rails
4+
cve: 2026-33168
5+
ghsa: v55j-83pf-r9cq
6+
url: https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
7+
title: Rails has a possible XSS vulnerability in its Action View tag helpers
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
When a blank string is used as an HTML attribute name in Action View tag helpers,
12+
the attribute escaping is bypassed, producing malformed HTML.
13+
A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name,
14+
possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.
15+
16+
### Releases
17+
The fixed releases are available at the normal locations.
18+
patched_versions:
19+
- "~> 7.2.3, >= 7.2.3.1"
20+
- "~> 8.0.4, >= 8.0.4.1"
21+
- ">= 8.1.2.1"
22+
related:
23+
url:
24+
- https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
25+
- https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
26+
- https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
27+
- https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
28+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
29+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
30+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
31+
- https://github.com/advisories/GHSA-v55j-83pf-r9cq

‎gems/activestorage/CVE-2026-33173.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: activestorage
3+
framework: rails
4+
cve: 2026-33173
5+
ghsa: qcfx-2mfw-w4cg
6+
url: https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
7+
title: Rails Active Storage has possible content type bypass via metadata in direct
8+
uploads
9+
date: 2026-03-23
10+
description: |
11+
### Impact
12+
Active Storage's `DirectUploadsController` accepts arbitrary metadata from the client and persists it on the blob.
13+
Because internal flags like `identified` and `analyzed` are stored in the same metadata hash,
14+
a malicious direct-upload client could set these flags.
15+
16+
### Releases
17+
The fixed releases are available at the normal locations.
18+
patched_versions:
19+
- "~> 7.2.3, >= 7.2.3.1"
20+
- "~> 8.0.4, >= 8.0.4.1"
21+
- ">= 8.1.2.1"
22+
related:
23+
url:
24+
- https://github.com/rails/rails/security/advisories/GHSA-qcfx-2mfw-w4cg
25+
- https://github.com/rails/rails/commit/707c0f1f41f067fdf96d54e99d43b28dfaae7e53
26+
- https://github.com/rails/rails/commit/8fcb934caadc79c8cc4ce53287046d0f67005b3e
27+
- https://github.com/rails/rails/commit/d9502f5214e2198245a4c1defe9cd02a7c8057d0
28+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
29+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
30+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
31+
- https://github.com/advisories/GHSA-qcfx-2mfw-w4cg

‎gems/activestorage/CVE-2026-33174.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
gem: activestorage
3+
framework: rails
4+
cve: 2026-33174
5+
ghsa: r46p-8f7g-vvvg
6+
url: https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
7+
title: Rails Active Storage has a possible DoS vulnerability when in proxy mode via
8+
Range requests
9+
date: 2026-03-23
10+
description: |
11+
### Impact
12+
When serving files through Active Storage's `Blobs::ProxyController`,
13+
the controller loads the entire requested byte range into memory before sending it.
14+
A request with a large or unbounded Range header (e.g. `bytes=0-`) could cause the server
15+
to allocate memory proportional to the file size, possibly resulting in a DoS vulnerability through memory exhaustion.
16+
17+
### Releases
18+
The fixed releases are available at the normal locations.
19+
patched_versions:
20+
- "~> 7.2.3, >= 7.2.3.1"
21+
- "~> 8.0.4, >= 8.0.4.1"
22+
- ">= 8.1.2.1"
23+
related:
24+
url:
25+
- https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
26+
- https://github.com/rails/rails/commit/2cd933c366b777f873d4d590127da2f4a25e4ba5
27+
- https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
28+
- https://github.com/rails/rails/commit/8159a9c3de3f27a2bcf2866b8bf9ceb9075e229b
29+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
30+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
31+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
32+
- https://github.com/advisories/GHSA-r46p-8f7g-vvvg

‎gems/activestorage/CVE-2026-33195.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: activestorage
3+
framework: rails
4+
cve: 2026-33195
5+
ghsa: 9xrj-h377-fr87
6+
url: https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
7+
title: Rails Active Storage has possible Path Traversal in DiskService
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
Active Storage's `DiskService#path_for` does not validate that the
12+
resolved filesystem path remains within the storage root directory.
13+
If a blob key containing path traversal sequences (e.g. `../`) is used,
14+
it could allow reading, writing, or deleting arbitrary files on the server.
15+
Blob keys are expected to be trusted strings,
16+
but some applications could be passing user input as keys and would be affected.
17+
18+
### Releases
19+
The fixed releases are available at the normal locations.
20+
patched_versions:
21+
- "~> 7.2.3, >= 7.2.3.1"
22+
- "~> 8.0.4, >= 8.0.4.1"
23+
- ">= 8.1.2.1"
24+
related:
25+
url:
26+
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
27+
- https://github.com/rails/rails/commit/4933c1e3b8c1bb04925d60347be9f69270392f2c
28+
- https://github.com/rails/rails/commit/9b06fbc0f504b8afe333f33d19548f3b85fbe655
29+
- https://github.com/rails/rails/commit/a290c8a1ec189d793aa6d7f2570b6a763f675348
30+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
31+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
32+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
33+
- https://github.com/advisories/GHSA-9xrj-h377-fr87

‎gems/activestorage/CVE-2026-33202.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
gem: activestorage
3+
framework: rails
4+
cve: 2026-33202
5+
ghsa: 73f9-jhhh-hr5m
6+
url: https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
7+
title: Rails Active Storage has possible glob injection in its DiskService
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
Active Storage's `DiskService#delete_prefixed` passes blob keys directly to `Dir.glob` without escaping glob metacharacters.
12+
If a blob key contains attacker-controlled input or custom-generated keys with glob metacharacters,
13+
it may be possible to delete unintended files from the storage directory.
14+
15+
### Releases
16+
The fixed releases are available at the normal locations.
17+
patched_versions:
18+
- "~> 7.2.3, >= 7.2.3.1"
19+
- "~> 8.0.4, >= 8.0.4.1"
20+
- ">= 8.1.2.1"
21+
related:
22+
url:
23+
- https://github.com/rails/rails/security/advisories/GHSA-73f9-jhhh-hr5m
24+
- https://github.com/rails/rails/commit/8c9676b803820110548cdb7523800db43bc6874c
25+
- https://github.com/rails/rails/commit/955284d26e469a9c026a4eee5b21f0414ab0bccf
26+
- https://github.com/rails/rails/commit/fa19073546360856e9f4dab221fc2c5d73a45e82
27+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
28+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
29+
- https://github.com/rails/rails/releases/tag/v8.1.2.1

‎gems/activesupport/CVE-2026-33169.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
gem: activesupport
3+
framework: rails
4+
cve: 2026-33169
5+
ghsa: cg4j-q9v8-6v38
6+
url: https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
7+
title: Rails Active Support has a possible ReDoS vulnerability in number_to_delimited
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
`NumberToDelimitedConverter` used a regular expression with `gsub!` to insert thousands delimiters.
12+
This could produce quadratic time complexity on long digit strings.
13+
14+
### Releases
15+
The fixed releases are available at the normal locations.
16+
patched_versions:
17+
- "~> 7.2.3, >= 7.2.3.1"
18+
- "~> 8.0.4, >= 8.0.4.1"
19+
- ">= 8.1.2.1"
20+
related:
21+
url:
22+
- https://github.com/rails/rails/security/advisories/GHSA-cg4j-q9v8-6v38
23+
- https://github.com/rails/rails/commit/29154f1097da13d48fdb3200760b3e3da66dcb11
24+
- https://github.com/rails/rails/commit/b54a4b373c6f042cab6ee2033246b1c9ecc38974
25+
- https://github.com/rails/rails/commit/ec1a0e215efd27a3b3911aae6df978a80f456a49
26+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
27+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
28+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
29+
- https://github.com/advisories/GHSA-cg4j-q9v8-6v38

‎gems/activesupport/CVE-2026-33170.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: activesupport
3+
framework: rails
4+
cve: 2026-33170
5+
ghsa: 89vf-4333-qx8v
6+
url: https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
7+
title: Rails Active Support has a possible XSS vulnerability in SafeBuffer#%
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
`SafeBuffer#%` does not propagate the `@html_unsafe` flag to the newly created buffer.
12+
If a `SafeBuffer` is mutated in place (e.g. via `gsub!`) and then formatted with `%` using untrusted arguments,
13+
the result incorrectly reports `html_safe? == true`, bypassing ERB auto-escaping and possibly leading to XSS.
14+
15+
### Releases
16+
The fixed releases are available at the normal locations.
17+
patched_versions:
18+
- "~> 7.2.3, >= 7.2.3.1"
19+
- "~> 8.0.4, >= 8.0.4.1"
20+
- ">= 8.1.2.1"
21+
related:
22+
url:
23+
- https://github.com/rails/rails/security/advisories/GHSA-89vf-4333-qx8v
24+
- https://github.com/rails/rails/commit/50d732af3b7c8aaf63cbcca0becbc00279b215b7
25+
- https://github.com/rails/rails/commit/6e8a81108001d58043de9e54a06fca58962fc2db
26+
- https://github.com/rails/rails/commit/c1ad0e8e1972032f3395853a5e99cea035035beb
27+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
28+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
29+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
30+
- https://github.com/advisories/GHSA-89vf-4333-qx8v

‎gems/activesupport/CVE-2026-33176.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: activesupport
3+
framework: rails
4+
cve: 2026-33176
5+
ghsa: 2j26-frm8-cmj9
6+
url: https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
7+
title: Rails Active Support has a possible DoS vulnerability in its number helpers
8+
date: 2026-03-23
9+
description: |
10+
### Impact
11+
Active Support number helpers accept strings containing scientific notation (e.g. `1e10000`),
12+
which when converted to a string could be expanded into extremely large decimal representations.
13+
This can cause excessive memory allocation and CPU consumption when the expanded number is formatted,
14+
possibly resulting in a DoS vulnerability.
15+
16+
### Releases
17+
The fixed releases are available at the normal locations.
18+
patched_versions:
19+
- "~> 7.2.3, >= 7.2.3.1"
20+
- "~> 8.0.4, >= 8.0.4.1"
21+
- ">= 8.1.2.1"
22+
related:
23+
url:
24+
- https://github.com/rails/rails/security/advisories/GHSA-2j26-frm8-cmj9
25+
- https://github.com/rails/rails/commit/19dbab51ca086a657bb86458042bc44314916bcb
26+
- https://github.com/rails/rails/commit/ebd6be18120d1136511eb516338e27af25ac0a1a
27+
- https://github.com/rails/rails/commit/ee2c59e730e5b8faed502cd2c573109df093f856
28+
- https://github.com/rails/rails/releases/tag/v7.2.3.1
29+
- https://github.com/rails/rails/releases/tag/v8.0.4.1
30+
- https://github.com/rails/rails/releases/tag/v8.1.2.1
31+
- https://github.com/advisories/GHSA-2j26-frm8-cmj9

0 commit comments

Comments
 (0)