Security Digest
Critical RubyGems advisories
33 critical advisories for RubyGems packages since October 2023, newest first. Check your project with bundle audit check --update.
- OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and… CVE-2026-77602 CVSS 9.9 Critical
openc3>= 5.1.0, <= 7.2.1 → fixed in 7.3.0 - kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) CVE-2026-55107 CVSS 10.0 Critical
kobako>= 0.1.0, <= 0.9.0 → fixed in 0.9.1 - Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing CVE-2026-66066 CVSS 9.5 Critical
activestorage< 7.2.3.2 → fixed in 7.2.3.2;activestorage>= 8.0.0.beta1, < 8.0.5.1 → fixed in 8.0.5.1;activestorage>= 8.1.0.beta1, < 8.1.3.1 → fixed in 8.1.3.1 - Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder CVE-2026-44024 CVSS 9.8 Critical
fluentd<= 1.19.2 → fixed in 1.19.3 - Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation CVE-2026-55518 CVSS 9.6 Critical
avo<= 3.32.0 → fixed in 3.32.1;avo>= 4.0.0.beta.1, < 4.0.0.beta.51 → fixed in 4.0.0.beta.51 - OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database CVE-2026-42087 CVSS 9.6 Critical
openc3>= 6.7.0, < 7.0.0-rc3 → fixed in 7.0.0-rc3 - OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool GHSA-2wvh-87g2-89hr CVSS 9.6 Critical
openc3< 7.0.0-rc3 → fixed in 7.0.0-rc3 - Decidim has a cross-site scripting (XSS) in user name CVE-2026-23891 CVSS 9.3 Critical
decidim-core>= 0.31.0.rc1, < 0.31.0 → fixed in 0.31.1;decidim-core< 0.30.5 → fixed in 0.30.5 - Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization CVE-2026-39324 CVSS 9.1 Critical
rack-session>= 2.0.0, < 2.1.2 → fixed in 2.1.2 - Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names CVE-2026-33286 CVSS 9.1 Critical
graphiti<= 1.10.1 → fixed in 1.10.2 - openc3-api Vulnerable to Unauthenticated Remote Code Execution CVE-2025-68271 CVSS 10.0 Critical
openc3>= 5.0.6, < 6.10.2 → fixed in 6.10.2 - Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation CVE-2025-66568 CVSS 9.3 Critical
ruby-saml< 1.18.0 → fixed in 1.18.0 - Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-66567 CVSS 9.3 Critical
ruby-saml< 1.18.0 → fixed in 1.18.0 - Spree Commerce is vulnerable to RCE through Search API CVE-2011-10026 CVSS 9.3 Critical
spree>= 0.30.0.beta1, < 0.50.0 → fixed in 0.50.0;rd_searchlogic<= 3.0.1 → no fix listed - Active Storage allowed transformation methods that were potentially unsafe CVE-2025-24293 CVSS 9.2 Critical
activestorage>= 8.0, < 8.0.2.1 → fixed in 8.0.2.1;activestorage>= 7.2, < 7.2.2.2 → fixed in 7.2.2.2;activestorage>= 5.2.0, < 7.1.5.2 → fixed in 7.1.5.2 - Spree has Remote Command Execution vulnerability in search functionality CVE-2011-10019 CVSS 10.0 Critical
spree< 0.60.2 → fixed in 0.60.2 - JWE is missing AES-GCM authentication tag validation in encrypted JWE CVE-2025-54887 CVSS 9.1 Critical
jwe<= 1.1.0 → fixed in 1.1.1 - Nokogiri patches vendored libxml2 to resolve multiple CVEs GHSA-353f-x4gh-cqq8
nokogiri< 1.18.9 → fixed in 1.18.9 - Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVE-2025-53623 CVSS 9.3 Critical
job-iteration< 1.11 → fixed in 1.11 - OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint CVE-2025-28384 CVSS 9.1 Critical
openc3-cosmos-tool-iframe= 6.0.0 → no fix listed - Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment CVE-2025-2304 CVSS 9.4 Critical
camaleon_cms< 2.9.1 → fixed in 2.9.1 - graphql allows remote code execution when loading a crafted GraphQL schema CVE-2025-27407 CVSS 9.0 Critical
graphql>= 2.4.0, < 2.4.13 → fixed in 2.4.13;graphql>= 2.3.0, < 2.3.21 → fixed in 2.3.21;graphql>= 2.0.0, < 2.0.32 → fixed in 2.0.32; +5 more packages - omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue GHSA-hw46-3hmr-x9xv
omniauth-saml>= 2.2.0, < 2.2.3 → fixed in 2.2.3;omniauth-saml>= 2.0.0, < 2.1.3 → fixed in 2.1.3;omniauth-saml< 1.10.6 → fixed in 1.10.6 - Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) CVE-2025-25292 CVSS 9.3 Critical
ruby-saml>= 1.13.0, < 1.18.0 → fixed in 1.18.0;ruby-saml< 1.12.4 → fixed in 1.12.4 - Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) CVE-2025-25291 CVSS 9.3 Critical
ruby-saml< 1.12.4 → fixed in 1.12.4;ruby-saml>= 1.13.0, < 1.18.0 → fixed in 1.18.0 - Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account CVE-2025-27590 CVSS 9.0 Critical
oxidized-web< 0.15.0 → fixed in 0.15.0 - omniauth-saml vulnerable to Improper Verification of Cryptographic Signature GHSA-cvp8-5r8g-fhvq CVSS 9.9 Critical
omniauth-saml>= 2.0.0, < 2.1.2 → fixed in 2.1.2;omniauth-saml< 1.10.5 → fixed in 1.10.5;omniauth-saml>= 2.2.0, < 2.2.1 → fixed in 2.2.1 - SAML authentication bypass via Incorrect XPath selector CVE-2024-45409 CVSS 9.9 Critical
ruby-saml< 1.12.3 → fixed in 1.12.3;ruby-saml>= 1.13.0, < 1.17.0 → fixed in 1.17.0 - Command Injection in sequenceserver CVE-2024-42360 CVSS 9.3 Critical
sequenceserver< 3.1.2 → fixed in 3.1.2 - StringIO buffer overread vulnerability CVE-2024-27280 CVSS 9.3 Critical
stringio< 3.0.1.1 → fixed in 3.0.1.1 - discordrb OS Command Injection vulnerability CVE-2023-28102 CVSS 9.6 Critical
discordrb< 3.4.3 → fixed in 3.4.3 - Puppet Bolt privilege escalation vulnerability CVE-2023-5214 CVSS 9.8 Critical
bolt< 3.27.4 → fixed in 3.27.4 - geokit-rails Command Injection vulnerability CVE-2023-26153 CVSS 9.8 Critical
geokit-rails< 2.5.0 → fixed in 2.5.0