Skip to content

Commit 5fdc4fb

Browse files
jasnowjasnow
authored
1 GHSA/SYNC; 1 modified; 4 brand new advisories (#1171)
1 parent f8d8ecd commit 5fdc4fb

6 files changed

Lines changed: 191 additions & 0 deletions

File tree

‎gems/datadog/CVE-2026-50276.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
gem: datadog
3+
cve: 2026-50276
4+
ghsa: p5f6-rccc-jv98
5+
url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
6+
title: dd-trace-rb - Improper parsing of W3C baggage headers may lead to DoS
7+
date: 2026-07-15
8+
description: |
9+
### Impact
10+
11+
Datadog tracing libraries that implement W3C baggage propagation parse
12+
incoming baggage HTTP headers without enforcing item-count or byte-size
13+
limits on the extract path. The DD_TRACE_BAGGAGE_MAX_ITEMS (default 64)
14+
and DD_TRACE_BAGGAGE_MAX_BYTES (default 8192) limits were applied only
15+
to baggage injection, not extraction. A remote, unauthenticated attacker
16+
can send a request whose baggage header contains an arbitrarily large
17+
number of comma-separated key-value pairs (or a single very large value).
18+
The tracer allocates a hash-map entry for each pair on every request,
19+
causing unbounded CPU and memory consumption and enabling a remote
20+
Denial of Service against any HTTP service that has the baggage
21+
propagation style enabled.
22+
The baggage propagation style is enabled by default in most affected
23+
tracers, so any internet-facing service that has been instrumented
24+
with an affected tracer version is exposed unless the propagation
25+
style has been explicitly narrowed.
26+
cvss_v3: 7.5
27+
patched_versions:
28+
- ">= 2.32.0"
29+
related:
30+
url:
31+
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-50276
32+
- https://nvd.nist.gov/vuln/detail/CVE-2026-50276
33+
- https://rubygems.org/gems/datadog/versions/2.32.0
34+
- https://github.com/DataDog/dd-trace-rb/blob/master/CHANGELOG.md#2320---2026-05-08
35+
- https://advisories.gitlab.com/gem/datadog/CVE-2026-50276
36+
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
37+
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j
38+
- https://github.com/DataDog/dd-trace-rb/security/advisories/GHSA-p5f6-rccc-jv98
39+
- https://github.com/advisories/GHSA-p5f6-rccc-jv98
40+
notes: |
41+
- cvss_v3 value comes from GHSA.
42+
- No CVE.

‎gems/erb/CVE-2026-41316.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ patched_versions:
2626
related:
2727
url:
2828
- https://nvd.nist.gov/vuln/detail/CVE-2026-41316
29+
- https://www.ruby-lang.org/en/news/2026/07/16/ruby-3-3-12-released
2930
- https://www.ruby-lang.org/en/news/2026/04/21/ruby-4-0-3-released
3031
- https://www.ruby-lang.org/en/news/2026/04/21/erb-cve-2026-41316
3132
- https://github.com/ruby/erb/blob/master/NEWS.md

‎gems/loofah/GHSA-5qhf-9phg-95m2.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
gem: loofah
3+
ghsa: 5qhf-9phg-95m2
4+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
5+
title: Loofah `allowed_uri?` does not detect `javascript:` URIs
6+
split by numeric character references without semicolons
7+
date: 2026-07-15
8+
description: |
9+
## Summary
10+
11+
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
12+
or vbscript: URIs when the scheme is split by a numeric character
13+
reference that has no trailing semicolon. A browser decodes such
14+
references and resolves the URL to an executable javascript: scheme,
15+
while allowed_uri? reports it safe.
16+
17+
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
18+
numeric character references with a trailing ; (	, 
, 
)
19+
but did not cover the forms without semicolons.
20+
21+
## Impact
22+
23+
Callers that validate a user-controlled URL with
24+
Loofah::HTML5::Scrub.allowed_uri? and then render the approved value
25+
into an href or other browser-interpreted URI attribute may be
26+
vulnerable to cross-site scripting (XSS). This includes applications
27+
that call allowed_uri? directly, as well as higher-level features
28+
built on top of it, such as Action Text 8.2's markdown link validation.
29+
30+
## Credit
31+
32+
Responsibly reported by GitHub user @MoonFuji.
33+
unaffected_versions:
34+
- "< 2.25.0"
35+
patched_versions:
36+
- ">= 2.25.2"
37+
related:
38+
url:
39+
- https://rubygems.org/gems/loofah/versions/2.25.2
40+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
41+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
42+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-5qhf-9phg-95m2
43+
notes: |
44+
- "Low" severity from GHSA
45+
- No CVE.

‎gems/loofah/GHSA-8whx-365g-h9vv.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
gem: loofah
3+
ghsa: 8whx-365g-h9vv
4+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
5+
title: Loofah `allowed_uri?` does not detect `javascript:` URIs
6+
split by named whitespace character references
7+
date: 2026-07-15
8+
description: |
9+
## Summary
10+
11+
Loofah::HTML5::Scrub.allowed_uri? does not correctly reject javascript:
12+
URIs when the scheme is split or prefixed by the HTML5 named character
13+
references &Tab; (tab) or &NewLine; (line feed).
14+
15+
This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled
16+
the equivalent numeric character references (&#9;, &#10;, &#13;) but
17+
did not cover the named forms.
18+
unaffected_versions:
19+
- "< 2.25.0"
20+
patched_versions:
21+
- ">= 2.25.2"
22+
related:
23+
url:
24+
- https://rubygems.org/gems/loofah/versions/2.25.2
25+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
26+
- https://github.com/advisories/GHSA-46fp-8f5p-pf2m
27+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-8whx-365g-h9vv
28+
notes: |
29+
- "Low" severity from GHSA
30+
- No CVE.

‎gems/loofah/GHSA-9wjq-cp2p-hrgf.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
gem: loofah
3+
ghsa: 9wjq-cp2p-hrgf
4+
url: https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
5+
title: SVG `href` attribute bypasses local-reference restriction in Loofah
6+
date: 2026-07-15
7+
description: |
8+
## Summary
9+
10+
Loofah's HTML5 sanitizer restricted only the xlink:href attribute on
11+
certain SVG elements to local, same-document references. Browsers
12+
also accept a plain href attribute as an alternative to the deprecated
13+
xlink:href per the SVG 2 spec, but Loofah did not apply the same
14+
restriction to it, allowing those elements to reference arbitrary
15+
external documents.
16+
17+
## Impact
18+
19+
SVG <use> can load and render external SVG content by reference. If
20+
the referenced external SVG is same-origin and contains scripts or
21+
other dangerous content, it could execute in the context of the
22+
sanitized document. <feImage> can load external images, which can be
23+
used for tracking. Modern browsers restrict cross-origin <use>
24+
fetches, which limits but does not eliminate the risk.
25+
26+
Applications that sanitize user-supplied SVG (directly, or as part
27+
of HTML) with Loofah's default allowlist are affected.
28+
29+
## Credit
30+
31+
Found by the maintainer, Mike Dalessio, during a security audit.
32+
cvss_v3: 4.7
33+
patched_versions:
34+
- ">= 2.25.2"
35+
related:
36+
url:
37+
- https://rubygems.org/gems/loofah/versions/2.25.2
38+
- https://github.com/flavorjones/loofah/blob/main/CHANGELOG.md#2252--2026-07-15
39+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
40+
notes: |
41+
- cvss_v3 value from GHSA
42+
- No CVE.

‎gems/rails-html-sanitizer/GHSA-cj75-f6xr-r4g7.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
gem: rails-html-sanitizer
3+
framework: rails
4+
ghsa: cj75-f6xr-r4g7
5+
url: https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
6+
title: Possible XSS vulnerability with certain configurations of
7+
rails-html-sanitizer
8+
date: 2026-07-15
9+
description: |
10+
## Summary
11+
12+
There is a possible cross-site scripting vulnerability in
13+
rails-html-sanitizer when the sanitizer is configured to allow an
14+
SVG reference element such as <use>.
15+
See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference
16+
logic rails-html-sanitizer mirrors.
17+
unaffected_versions:
18+
- "< 1.0.3"
19+
patched_versions:
20+
- ">= 1.7.1"
21+
related:
22+
url:
23+
- https://rubygems.org/gems/rails-html-sanitizer/versions/1.7.1
24+
- https://github.com/rails/rails-html-sanitizer/blob/main/CHANGELOG.md#v171--2026-07-15
25+
- https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586
26+
- https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359#post_1
27+
- https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf
28+
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
29+
notes: |
30+
- "Moderate" severity in GHSA
31+
- No CVE.

0 commit comments

Comments
 (0)