Skip to content

Commit 79e3e37

Browse files
jasnowjasnow
authored
Merge branch 'rubysec:master' into add-check-indents-spec
2 parents db6a6c1 + b1e3c15 commit 79e3e37

File tree

5 files changed

+160
-2
lines changed

5 files changed

+160
-2
lines changed

‎gems/action_text-trix/GHSA-53p3-c7vp-4mcc.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
---
2+
gem: action_text-trix
3+
ghsa: 53p3-c7vp-4mcc
4+
url: https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
5+
title: Trix is vulnerable to XSS through JSON deserialization bypass
6+
in drag-and-drop (Level0InputController)
7+
date: 2026-03-29
8+
description: |
9+
### Impact
10+
11+
The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS
12+
when a crafted `application/x-trix-document` JSON payload is dropped
13+
into the editor in environments using the fallback Level0InputController
14+
(e.g., embedded WebViews lacking Input Events Level 2 support).
15+
16+
The `StringPiece.fromJSON` method trusted `href` attributes from the
17+
JSON payload without sanitization. An attacker could craft a draggable
18+
element containing a `javascript:` URI in the href attribute that,
19+
when dropped into a vulnerable editor, would bypass DOMPurify
20+
sanitization and inject executable JavaScript into the DOM.
21+
22+
Exploitation requires a specific environment (Level0InputController
23+
fallback) and social engineering (victim must drag and drop
24+
attacker-controlled content into the editor). Applications using
25+
server-side HTML sanitization (such as Rails' built-in sanitizer)
26+
are additionally protected, as the payload is neutralized on save.
27+
28+
### Patches
29+
30+
Update Recommendation: Users should upgrade to Trix editor
31+
version 2.1.18 or later.
32+
33+
### References
34+
35+
The XSS vulnerability was responsibly reported by Hackerone
36+
researcher [newbiefromcoma](https://hackerone.com/newbiefromcoma).
37+
patched_versions:
38+
- ">= 2.1.18"
39+
related:
40+
url:
41+
- https://github.com/basecamp/trix/security/advisories/GHSA-53p3-c7vp-4mcc
42+
- https://github.com/basecamp/trix/releases/tag/v2.1.18
43+
- https://github.com/basecamp/trix/commit/9c0a993d9fc2ffe9d56b013b030bc238f9c0557c
44+
- https://github.com/advisories/GHSA-53p3-c7vp-4mcc

‎gems/activestorage/CVE-2026-33658.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ description: |
1515
ranges causes disproportionate CPU usage compared to a normal
1616
request for the same file, possibly resulting in a DoS vulnerability.
1717
patched_versions:
18-
- "~> 7.2.3.1"
19-
- "~> 8.0.4.1"
18+
- "~> 7.2.3, >= 7.2.3.1"
19+
- "~> 8.0.4, >= 8.0.4.1"
2020
- ">= 8.1.2.1"
2121
related:
2222
url:

‎gems/loofah/GHSA-46fp-8f5p-pf2m.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,4 +48,7 @@ patched_versions:
4848
related:
4949
url:
5050
- https://github.com/flavorjones/loofah/security/advisories/GHSA-46fp-8f5p-pf2m
51+
- https://github.com/flavorjones/loofah/releases/tag/v2.25.1
52+
- https://github.com/flavorjones/loofah/commit/f4ebc9c5193dde759a57541062e490e86fc7c068
53+
- https://github.com/advisories/GHSA-2j22-pr5w-6gq8
5154
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m

‎gems/mcp/CVE-2026-33946.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
gem: mcp
3+
cve: 2026-33946
4+
ghsa: qvqr-5cv7-wh35
5+
url: https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35
6+
title: MCP Ruby SDK - Insufficient Session Binding Allows SSE
7+
Stream Hijacking via Session ID Replay
8+
date: 2026-03-27
9+
description: |
10+
### Summary
11+
12+
The Ruby SDK's [streamable_http_transport.rb](https://github.com/modelcontextprotocol/ruby-sdk/blob/main/lib/mcp/server/transports/streamable_http_transport.rb)
13+
implementation contains a session hijacking vulnerability. An attacker
14+
who obtains a valid session ID can completely hijack the victim's
15+
Server-Sent Events (SSE) stream and intercept all real-time data.
16+
17+
### Details
18+
19+
**Root Cause**
20+
21+
The StreamableHTTPTransport implementation stores only one SSE stream
22+
object per session ID and lacks:
23+
24+
- Session-to-user identity binding
25+
- Ownership validation when establishing SSE connections
26+
- Protection against multiple simultaneous connections to the same session
27+
28+
### Impact
29+
30+
While the absence of user binding may not pose immediate risks if
31+
session IDs are not used to store sensitive data or state, the
32+
fundamental purpose of session IDs is to maintain stateful connections.
33+
If the SDK or its consumers utilize session IDs for sensitive operations
34+
without proper user binding controls, this creates a potential security
35+
vulnerability. For example: In the case of the Ruby SDK, the attacker
36+
was able to hijack the stream and receive all the tool responses
37+
belonging to the victim. The tool responses can be sensitive
38+
confidential data.
39+
cvss_v3: 8.2
40+
patched_versions:
41+
- ">= 0.9.2"
42+
related:
43+
url:
44+
- https://www.cve.org/CVERecord?id=CVE-2026-33946
45+
- https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.9.2
46+
- https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35
47+
- https://github.com/modelcontextprotocol/ruby-sdk/blob/main/examples/streamable_http_server.rb
48+
- https://github.com/modelcontextprotocol/ruby-sdk/commit/db40143402d65b4fb6923cec42d2d72cb89b3874
49+
- https://hackerone.com/reports/3556146
50+
- https://github.com/modelcontextprotocol/csharp-sdk/blob/main/src/ModelContextProtocol.AspNetCore/SseHandler.cs#L93-L97
51+
- https://github.com/modelcontextprotocol/go-sdk/blob/main/mcp/streamable.go#L281C1-L288C2
52+
- https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/streamable_http.py#L680-L685
53+
- https://github.com/advisories/GHSA-qvqr-5cv7-wh35

‎gems/ruby-lsp/CVE-2026-34060.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
gem: ruby-lsp
3+
cve: 2026-34060
4+
ghsa: c4r5-fxqw-vh93
5+
url: https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93
6+
title: Ruby LSP has arbitrary code execution through branch setting
7+
date: 2026-03-27
8+
description: |
9+
10+
## Summary
11+
12+
The `rubyLsp.branch` VS Code workspace setting was interpolated without
13+
sanitization into a generated Gemfile, allowing arbitrary Ruby code
14+
execution when a user opens a project containing a malicious
15+
`.vscode/settings.json`.
16+
17+
Other editors that support workspace setting that get automatically
18+
applied upon opening the editor and trusting the workspace are also
19+
impacted since the server is the component that performs the interpolation.
20+
21+
## Details
22+
23+
The `branch` CLI argument passed to the `ruby-lsp` server was
24+
interpolated in the generated `.ruby-lsp/Gemfile` without sanitization.
25+
Editors that allow defining settings saved at the workspace level
26+
(e.g.: `.vscode/settings.json`) that gets automatically applied open
27+
the possibility to craft a malicious repository that once opened and
28+
trusted in the editor would run arbitrary code.
29+
30+
## Impact
31+
32+
Code execution with the privileges of the user who opens the malicious
33+
project. Ruby LSP assumes workspace code is trusted and so opening
34+
the editor on an untrusted workspace can lead to executing potentially
35+
dangerous code.
36+
37+
## Remediation
38+
39+
The `rubyLsp.branch` setting has been removed entirely. VS Code extensions
40+
auto-update by default, so most users will receive the fix without
41+
action. Users who have disabled auto-updates should update to extension
42+
version >= 0.10.2.
43+
44+
The `branch` CLI flag was also entirely removed from the `ruby-lsp`
45+
gem. For users that don't add `ruby-lsp` to their Gemfiles, the
46+
server should auto-update. Users with the `ruby-lsp` in the Gemfile
47+
and locked to a specific version should update to >= 0.26.9.
48+
cvss_v2: 7.5
49+
cvss_v3: 9.8
50+
cvss_v4: 7.1
51+
patched_versions:
52+
- ">= 0.26.9"
53+
related:
54+
url:
55+
- https://www.tenable.com/cve/CVE-2026-34060
56+
- https://github.com/Shopify/ruby-lsp/security/advisories/GHSA-c4r5-fxqw-vh93
57+
- https://github.com/Shopify/ruby-lsp/releases/tag/v0.26.9
58+
- https://github.com/advisories/GHSA-c4r5-fxqw-vh93

0 commit comments

Comments
 (0)