<![CDATA[RubySec]]>2026-09-16T14:36:49+00:00https://rubysec.com/Jekyll<![CDATA[CVE-2026-88030 (mongo): MongoDB Ruby Driver - Improper neutralization of special elements in data query logic in the GridFS component]]>https://rubysec.com/advisories/CVE-2026-880302026-09-10T00:00:00+00:00<![CDATA[CVE-2026-85396 (rubyzip): path traversal vulnerability in pre-3.4.0 rubyzip gem]]>https://rubysec.com/advisories/CVE-2026-853962026-09-03T00:00:00+00:00<![CDATA[GHSA-g7vv-4mjj-6fgm (alchemy_cms): Account Takeover & Privilege-Escalation To Admin via Stored XSS in Menu Node Name Rendered in Page Properties Configure Dialog]]>https://rubysec.com/advisories/GHSA-g7vv-4mjj-6fgm2026-09-02T00:00:00+00:00<![CDATA[GHSA-4qhx-6wrv-5hg2 (alchemy_cms): Account Takeover & Privilege-Escalation To Admin via Stored XSS in Menu Node Name Rendered in Admin Configure Dialog Page Content]]>https://rubysec.com/advisories/GHSA-4qhx-6wrv-5hg22026-09-02T00:00:00+00:00<![CDATA[CVE-2026-81097 (rails-mcp-server): The execute_ruby tool is documented as a read-only Ruby sandbox]]>https://rubysec.com/advisories/CVE-2026-810972026-08-27T00:00:00+00:00<![CDATA[CVE-2026-80213 (resolv): CVE-2026-80213 - Hostname validation bypass]]>https://rubysec.com/advisories/CVE-2026-802132026-08-27T00:00:00+00:00<![CDATA[CVE-2026-80212 (resolv): CVE-2026-80212 - Memory exhaustion through malicious DNS responses]]>https://rubysec.com/advisories/CVE-2026-802122026-08-27T00:00:00+00:00<![CDATA[CVE-2026-55107 (kobako): kobako Sandbox Escape - guest eval reaches host RCE via method_missing → public_send (any bound Service)]]>https://rubysec.com/advisories/CVE-2026-551072026-08-18T00:00:00+00:00<![CDATA[GHSA-rmxg-5p3r-j6hh (graphql): Unsafe Marshal deserialization in the parser cache can lead to arbitrary Ruby code execution]]>https://rubysec.com/advisories/GHSA-rmxg-5p3r-j6hh2026-08-17T00:00:00+00:00<![CDATA[CVE-2026-67991 (ruby_llm): Polynomial-Time Regular Expression Denial of Service (ReDoS) vulnerability]]>https://rubysec.com/advisories/CVE-2026-679912026-08-13T00:00:00+00:00<![CDATA[CVE-2026-73330 (camaleon_cms): CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action]]>https://rubysec.com/advisories/CVE-2026-733302026-08-12T00:00:00+00:00<![CDATA[GHSA-mwm8-39rw-8826 (sqlite3): Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array]]>https://rubysec.com/advisories/GHSA-mwm8-39rw-88262026-08-11T00:00:00+00:00<![CDATA[CVE-2026-71847 (json): Ruby JSON - JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams]]>https://rubysec.com/advisories/CVE-2026-718472026-08-07T00:00:00+00:00<![CDATA[CVE-2026-66748 (camaleon_cms): Camaleon CMS (2.1.1 to 2.9.1) contains an authenticated RCE vulnerability]]>https://rubysec.com/advisories/CVE-2026-667482026-07-31T00:00:00+00:00<![CDATA[GHSA-pmwx-rm49-xv39 (activerecord-tenanted): ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path traversal]]>https://rubysec.com/advisories/GHSA-pmwx-rm49-xv392026-07-29T00:00:00+00:00<![CDATA[CVE-2026-66066 (activestorage): Possible arbitrary file read and remote code execution in Active Storage variant processing]]>https://rubysec.com/advisories/CVE-2026-660662026-07-29T00:00:00+00:00= 8.13 is present on the system, applications can disable
the unfuzzed operations without upgrading Rails by setting the
VIPS_BLOCK_UNTRUSTED environment variable, which libvips reads while
initializing.
Applications also running ruby-vips >= 2.2.1 or later can instead call
Vips.block_untrusted(true) from an initializer.
## Credit
This issue was responsibly reported by 0xacb, s3np41k1r1t0 and castilho
from Ethiack, and RyotaK from GMO Flatt Security Inc..]]><![CDATA[GHSA-wppq-8h64-w78r (alchemy_cms): Unauthenticated navigation-tree disclosure via GET /api/nodes (missing authorization)]]>https://rubysec.com/advisories/GHSA-wppq-8h64-w78r2026-07-28T00:00:00+00:00<![CDATA[GHSA-r827-6rm4-59pg (alchemy_cms): Stored XSS via unsanitized SVG attachment replacement]]>https://rubysec.com/advisories/GHSA-r827-6rm4-59pg2026-07-28T00:00:00+00:00 / onload= payloads. Because
the sanitizer never runs on this path, and because AlchemyCMS explicitly
configures SVG as an inline-servable content type on Active Storage,
the public, unauthenticated /attachment/:id/show route streams the
attacker's raw SVG payload with Content-Disposition: inline. Any
visitor (including other admins) who opens the attachment URL executes
attacker-controlled JavaScript in the AlchemyCMS application origin.
This is a stored, privilege-crossing Cross-Site Scripting vulnerability,
confirmed both by static code review and by live dynamic reproduction
against an unmodified AlchemyCMS instance.]]><![CDATA[CVE-2026-54659 (pagy): Pagy I18n locale option is not validated before being used in a file path]]>https://rubysec.com/advisories/CVE-2026-546592026-07-28T00:00:00+00:00.yml`). An
application that assigns untrusted input to the locale — e.g. the common
pattern `Pagy::I18n.locale = params[:locale]` — let that input influence
which file Pagy attempted to load.
### Impact
Information disclosure (CWE-22 / CWE-200): a file-existence / readability
oracle for `.yml` paths on the host, plus a server-side read of
attacker-chosen files into the process. The file contents are not
returned in the response.
Only applications that pass **unsanitized end-user input** into
`Pagy::I18n.locale=` are affected. Applications that set the locale from
trusted values are not affected.]]><![CDATA[GHSA-m5f6-4589-m89f (blazer): Stored XSS vulnerability]]>https://rubysec.com/advisories/GHSA-m5f6-4589-m89f2026-07-27T00:00:00+00:00