---
title: "Critical RubyGems advisories"
url: https://erroneo.us/security/ecosystem/rubygems/
description: "All 33 critical GitHub-reviewed RubyGems security advisories since October 2023, newest first, with vulnerable ranges and fixed versions."
type: ecosystem
section: "Security Digest"
date_modified: 2026-09-23
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Critical RubyGems advisories

- 2026-09-23 [CVE-2026-77602](https://erroneo.us/security/cve/CVE-2026-77602/index.md) OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites) — openc3 >= 5.1.0, <= 7.2.1 → 7.3.0
- 2026-08-18 [CVE-2026-55107](https://erroneo.us/security/cve/CVE-2026-55107/index.md) kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service) — kobako >= 0.1.0, <= 0.9.0 → 0.9.1
- 2026-07-30 [CVE-2026-66066](https://erroneo.us/security/cve/CVE-2026-66066/index.md) Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing — activestorage < 7.2.3.2 → 7.2.3.2; activestorage >= 8.0.0.beta1, < 8.0.5.1 → 8.0.5.1; activestorage >= 8.1.0.beta1, < 8.1.3.1 → 8.1.3.1
- 2026-06-26 [CVE-2026-44024](https://erroneo.us/security/cve/CVE-2026-44024/index.md) Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder — fluentd <= 1.19.2 → 1.19.3
- 2026-06-17 [CVE-2026-55518](https://erroneo.us/security/cve/CVE-2026-55518/index.md) Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation — avo <= 3.32.0 → 3.32.1; avo >= 4.0.0.beta.1, < 4.0.0.beta.51 → 4.0.0.beta.51
- 2026-04-23 [CVE-2026-42087](https://erroneo.us/security/cve/CVE-2026-42087/index.md) OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database — openc3 >= 6.7.0, < 7.0.0-rc3 → 7.0.0-rc3
- 2026-04-23 [GHSA-2wvh-87g2-89hr](https://erroneo.us/security/ghsa/GHSA-2wvh-87g2-89hr/index.md) OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool — openc3 < 7.0.0-rc3 → 7.0.0-rc3
- 2026-04-13 [CVE-2026-23891](https://erroneo.us/security/cve/CVE-2026-23891/index.md) Decidim has a cross-site scripting (XSS) in user name — decidim-core >= 0.31.0.rc1, < 0.31.0 → 0.31.1; decidim-core < 0.30.5 → 0.30.5
- 2026-04-07 [CVE-2026-39324](https://erroneo.us/security/cve/CVE-2026-39324/index.md) Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization — rack-session >= 2.0.0, < 2.1.2 → 2.1.2
- 2026-03-20 [CVE-2026-33286](https://erroneo.us/security/cve/CVE-2026-33286/index.md) Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names — graphiti <= 1.10.1 → 1.10.2
- 2026-01-13 [CVE-2025-68271](https://erroneo.us/security/cve/CVE-2025-68271/index.md) openc3-api Vulnerable to Unauthenticated Remote Code Execution — openc3 >= 5.0.6, < 6.10.2 → 6.10.2
- 2025-12-08 [CVE-2025-66568](https://erroneo.us/security/cve/CVE-2025-66568/index.md) Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation — ruby-saml < 1.18.0 → 1.18.0
- 2025-12-08 [CVE-2025-66567](https://erroneo.us/security/cve/CVE-2025-66567/index.md) Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) — ruby-saml < 1.18.0 → 1.18.0
- 2025-08-20 [CVE-2011-10026](https://erroneo.us/security/cve/CVE-2011-10026/index.md) Spree Commerce is vulnerable to RCE through Search API — spree >= 0.30.0.beta1, < 0.50.0 → 0.50.0; rd_searchlogic <= 3.0.1 → no fix
- 2025-08-13 [CVE-2025-24293](https://erroneo.us/security/cve/CVE-2025-24293/index.md) Active Storage allowed transformation methods that were potentially unsafe — activestorage >= 8.0, < 8.0.2.1 → 8.0.2.1; activestorage >= 7.2, < 7.2.2.2 → 7.2.2.2; activestorage >= 5.2.0, < 7.1.5.2 → 7.1.5.2
- 2025-08-13 [CVE-2011-10019](https://erroneo.us/security/cve/CVE-2011-10019/index.md) Spree has Remote Command Execution vulnerability in search functionality — spree < 0.60.2 → 0.60.2
- 2025-08-07 [CVE-2025-54887](https://erroneo.us/security/cve/CVE-2025-54887/index.md) JWE is missing AES-GCM authentication tag validation in encrypted JWE — jwe <= 1.1.0 → 1.1.1
- 2025-07-21 [GHSA-353f-x4gh-cqq8](https://erroneo.us/security/ghsa/GHSA-353f-x4gh-cqq8/index.md) Nokogiri patches vendored libxml2 to resolve multiple CVEs — nokogiri < 1.18.9 → 1.18.9
- 2025-07-14 [CVE-2025-53623](https://erroneo.us/security/cve/CVE-2025-53623/index.md) Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class — job-iteration < 1.11 → 1.11
- 2025-06-13 [CVE-2025-28384](https://erroneo.us/security/cve/CVE-2025-28384/index.md) OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint — openc3-cosmos-tool-iframe = 6.0.0 → no fix
- 2025-03-14 [CVE-2025-2304](https://erroneo.us/security/cve/CVE-2025-2304/index.md) Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment — camaleon_cms < 2.9.1 → 2.9.1
- 2025-03-12 [CVE-2025-27407](https://erroneo.us/security/cve/CVE-2025-27407/index.md) graphql allows remote code execution when loading a crafted GraphQL schema — graphql >= 2.4.0, < 2.4.13 → 2.4.13; graphql >= 2.3.0, < 2.3.21 → 2.3.21; graphql >= 2.0.0, < 2.0.32 → 2.0.32
- 2025-03-12 [GHSA-hw46-3hmr-x9xv](https://erroneo.us/security/ghsa/GHSA-hw46-3hmr-x9xv/index.md) omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue — omniauth-saml >= 2.2.0, < 2.2.3 → 2.2.3; omniauth-saml >= 2.0.0, < 2.1.3 → 2.1.3; omniauth-saml < 1.10.6 → 1.10.6
- 2025-03-12 [CVE-2025-25292](https://erroneo.us/security/cve/CVE-2025-25292/index.md) Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) — ruby-saml >= 1.13.0, < 1.18.0 → 1.18.0; ruby-saml < 1.12.4 → 1.12.4
- 2025-03-12 [CVE-2025-25291](https://erroneo.us/security/cve/CVE-2025-25291/index.md) Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential) — ruby-saml < 1.12.4 → 1.12.4; ruby-saml >= 1.13.0, < 1.18.0 → 1.18.0
- 2025-03-02 [CVE-2025-27590](https://erroneo.us/security/cve/CVE-2025-27590/index.md) Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account — oxidized-web < 0.15.0 → 0.15.0
- 2024-09-11 [GHSA-cvp8-5r8g-fhvq](https://erroneo.us/security/ghsa/GHSA-cvp8-5r8g-fhvq/index.md) omniauth-saml vulnerable to Improper Verification of Cryptographic Signature — omniauth-saml >= 2.0.0, < 2.1.2 → 2.1.2; omniauth-saml < 1.10.5 → 1.10.5; omniauth-saml >= 2.2.0, < 2.2.1 → 2.2.1
- 2024-09-10 [CVE-2024-45409](https://erroneo.us/security/cve/CVE-2024-45409/index.md) SAML authentication bypass via Incorrect XPath selector — ruby-saml < 1.12.3 → 1.12.3; ruby-saml >= 1.13.0, < 1.17.0 → 1.17.0
- 2024-08-13 [CVE-2024-42360](https://erroneo.us/security/cve/CVE-2024-42360/index.md) Command Injection in sequenceserver — sequenceserver < 3.1.2 → 3.1.2
- 2024-03-25 [CVE-2024-27280](https://erroneo.us/security/cve/CVE-2024-27280/index.md) StringIO buffer overread vulnerability — stringio < 3.0.1.1 → 3.0.1.1
- 2024-03-14 [CVE-2023-28102](https://erroneo.us/security/cve/CVE-2023-28102/index.md) discordrb OS Command Injection vulnerability — discordrb < 3.4.3 → 3.4.3
- 2023-10-06 [CVE-2023-5214](https://erroneo.us/security/cve/CVE-2023-5214/index.md) Puppet Bolt privilege escalation vulnerability — bolt < 3.27.4 → 3.27.4
- 2023-10-05 [CVE-2023-26153](https://erroneo.us/security/cve/CVE-2023-26153/index.md) geokit-rails Command Injection vulnerability — geokit-rails < 2.5.0 → 2.5.0

---
Source page: https://erroneo.us/security/ecosystem/rubygems/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt