Skip to content

Commit 4eb715a

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@33c54d2 
1 parent b6ea057 commit 4eb715a

4 files changed

Lines changed: 193 additions & 0 deletions

File tree

‎advisories/_posts/2026-06-01-CVE-2026-53727.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-53727 (css_parser): SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`'
4+
comments: false
5+
categories:
6+
- css_parser
7+
advisory:
8+
gem: css_parser
9+
cve: 2026-53727
10+
ghsa: 9pmc-p236-855h
11+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727
12+
title: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file`
13+
date: 2026-06-01
14+
description: |-
15+
## Summary
16+
17+
CssParser::Parser#read_remote_file (and therefore load_uri!, and the
18+
@import-following branch of add_block!) issues HTTP/HTTPS requests
19+
against any host, port and URI it is handed, with no scheme allowlist,
20+
no host / IP filtering, and no protection against link-local, loopback
21+
or RFC‑1918 addresses. Location: redirects are followed recursively
22+
back into the same function, which also services file:// URIs, so a
23+
single attacker-controlled HTTP redirect upgrades the bug from SSRF
24+
to arbitrary local file disclosure.
25+
26+
In practice, any consumer of css_parser that hands it attacker‑influenced
27+
CSS together with a base_uri: option — Premailer being the canonical
28+
example — is exposed. The attacker only needs the ability to land one
29+
@import url(...) in the CSS that the host application parses.
30+
cvss_v4: 8.9
31+
unaffected_versions:
32+
- "< 2.2.0"
33+
patched_versions:
34+
- ">= 3.0.0"
35+
related:
36+
url:
37+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727
38+
- https://rubygems.org/gems/css_parser/versions/3.0.0
39+
- https://github.com/premailer/css_parser/blob/master/CHANGELOG.md#version-300
40+
- https://github.com/premailer/css_parser/security/advisories/GHSA-9pmc-p236-855h
41+
notes: "- CVE is reserved, but not published so no cvss values.\n"
42+
---

‎advisories/_posts/2026-06-03-CVE-2026-54163.md‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54163 (secure_headers): CSP directive injection via sandbox, plugin_types,
4+
and report_to when given untrusted input'
5+
comments: false
6+
categories:
7+
- secure_headers
8+
advisory:
9+
gem: secure_headers
10+
cve: 2026-54163
11+
ghsa: rqq5-2gf9-4w4q
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54163
13+
title: CSP directive injection via sandbox, plugin_types, and report_to when given
14+
untrusted input
15+
date: 2026-06-03
16+
description: |-
17+
## Summary
18+
19+
secure_headers builds the Content-Security-Policy value by stitching
20+
every configured directive together with ; separators. Three directive
21+
builders (build_sandbox_list_directive, build_media_type_list_directive,
22+
build_report_to_directive) interpolate caller-supplied strings into
23+
that value without scrubbing ;, \r, or \n.
24+
25+
When an application forwards untrusted input into
26+
SecureHeaders.override_content_security_policy_directives (or append_…)
27+
for :sandbox, :plugin_types, or :report_to, an attacker can embed a
28+
literal ; and inject an arbitrary CSP directive into the header value.
29+
Because :sandbox and :plugin_types both sort alphabetically before
30+
:script_src in BODY_DIRECTIVES, the injected script-src lands earlier
31+
in the header and wins under the CSP first-occurrence rule, defeating
32+
the application's real script-src. End result: an 'unsafe-inline' * policy
33+
is forced for inline <script> despite the configured strict CSP, giving
34+
full XSS reachability anywhere reflected or stored content meets one of
35+
these three sinks.
36+
37+
An existing ;/\n scrub is already present in the source-list builder
38+
(build_source_list_directive), but the three sibling builders here
39+
never received the same treatment and still emit caller bytes verbatim
40+
into the CSP value.
41+
42+
## Impact
43+
44+
Although piping untrusted input into CSP directives is generally
45+
discouraged, applications that do so for one of the three uncovered
46+
directives turn that endpoint into an XSS sink with an effective *
47+
'unsafe-inline' script-src, even though the global config says
48+
script_src: %w('self'). The same primitive can also be used to point
49+
report-to / report-uri at attacker infrastructure to silently siphon
50+
CSP violation reports — which include the violated URL, blocked-uri,
51+
source-file, line-number and a sample-snippet, useful for
52+
fingerprinting and for harvesting victim-internal URLs.
53+
54+
The global default CSP set in Configuration.default is supposed to
55+
be a backstop: even if a controller appends a single risky value,
56+
the strict script-src should remain the first match. This bug breaks
57+
that property by letting the appended value redefine the policy header
58+
upstream of the legitimate script-src.
59+
cvss_v3: 4.7
60+
patched_versions:
61+
- ">= 7.3.0"
62+
related:
63+
url:
64+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54163
65+
- https://rubygems.org/gems/secure_headers/versions/7.3.0
66+
- https://github.com/github/secure_headers/releases/tag/v7.3.0
67+
- https://github.com/github/secure_headers/commit/286a79dea80c6a9be4ca93e0f284c923cf77e539
68+
- https://github.com/github/secure_headers/security/advisories/GHSA-rqq5-2gf9-4w4q
69+
notes: |
70+
- CVE is reserved, but not published so no cvss_v2 or cvss_v4 values.
71+
- CHANGELOG only goes to 6.5.0.
72+
---

‎advisories/_posts/2026-06-09-CVE-2026-54522.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54522 (msgpack): DFVULN-839 - Use-After-Free in MessagePack::Buffer#clear
4+
Enables Cross-Buffer Disclosure'
5+
comments: false
6+
categories:
7+
- msgpack
8+
advisory:
9+
gem: msgpack
10+
cve: 2026-54522
11+
ghsa: 4mrv-5p47-p938
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522
13+
title: DFVULN-839 - Use-After-Free in MessagePack::Buffer#clear Enables Cross-Buffer
14+
Disclosure
15+
date: 2026-06-09
16+
description: |-
17+
## Summary
18+
19+
MessagePack::Buffer#clear shifts out every chunk and returns its
20+
4 KiB rmem page to the shared pool, but does not reset the buffer's
21+
rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees
22+
"unused rmem space" left over from the freed page and hands back a
23+
slice of memory that has already been returned to the pool. A second
24+
MessagePack::Buffer then re-acquires that same page, so reading the
25+
cleared-and-rewritten buffer discloses the second buffer's bytes — a
26+
same-process use-after-free with cross-buffer information
27+
disclosure (and the symmetric write-corruption).
28+
patched_versions:
29+
- ">= 1.8.2"
30+
related:
31+
url:
32+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522
33+
- https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog
34+
- https://github.com/msgpack/msgpack-ruby/compare/v1.8.1...v1.8.2
35+
- https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938
36+
notes: "- CVE is reserved, but not published so no cvss values.\n"
37+
---

‎advisories/_posts/2026-06-10-CVE-2026-53510.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-53510 (savon): Savon::Model evaluates WSDL operation names as Ruby
4+
source'
5+
comments: false
6+
categories:
7+
- savon
8+
advisory:
9+
gem: savon
10+
cve: 2026-53510
11+
ghsa: mx5j-mp4f-g8jg
12+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510
13+
title: Savon::Model evaluates WSDL operation names as Ruby source
14+
date: 2026-06-10
15+
description: |-
16+
Savon::Model generated SOAP operation methods by interpolating
17+
operation names into Ruby source passed to module_eval. An attacker
18+
who can control the operation names of a WSDL, can inject Ruby code
19+
that executes in the application process. This affects only the
20+
.all_operations class method provided by Savon::Model to automatically
21+
register all operations provided by the WSDL. Configuring Savon::Model
22+
with trusted operation names via .operations is safe.
23+
24+
Thanks to @connorshea for securely disclosing this, providing
25+
a proof and a great report.
26+
cvss_v3: 8.1
27+
unaffected_versions:
28+
- "< 0.9.8"
29+
patched_versions:
30+
- ">= 2.17.2"
31+
related:
32+
url:
33+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510
34+
- https://github.com/savonrb/savon/releases/tag/v2.17.2
35+
- https://github.com/savonrb/savon/blob/main/CHANGELOG.md#2172---2026-06-10
36+
- https://github.com/savonrb/savon/blob/v2.17.1/lib/savon/model.rb#L30-L45
37+
- https://gist.github.com/connorshea/6cdc951abe0e1ffd2d1cc0fa7cd6b74d
38+
- https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg
39+
notes: |
40+
- Found CVE # in CHANGELOG file.
41+
- CVE is reserved, but not published so no non-GHSA cvss values.
42+
---

0 commit comments

Comments
 (0)