Skip to content

Commit 3896238

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@cdb9d50 
1 parent 55341a6 commit 3896238

3 files changed

Lines changed: 154 additions & 0 deletions

File tree

‎advisories/_posts/2026-07-11-GHSA-h5xx-m7vj-5vg2.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-h5xx-m7vj-5vg2 (activity_notification): SQL Injection via custom_filter
4+
in Bulk Notification Endpoints'
5+
comments: false
6+
categories:
7+
- activity_notification
8+
advisory:
9+
gem: activity_notification
10+
ghsa: h5xx-m7vj-5vg2
11+
url: https://github.com/simukappu/activity_notification/security/advisories/GHSA-h5xx-m7vj-5vg2
12+
title: SQL Injection via custom_filter in Bulk Notification Endpoints
13+
date: 2026-07-11
14+
description: |-
15+
## Summary
16+
17+
The notifications_api_controller.rb bulk endpoints (open_all and
18+
destroy_all) pass unfiltered request parameters to filtered_by_options,
19+
which passes a custom_filter value directly to ActiveRecord's where()
20+
as a raw SQL string. An unauthenticated attacker can inject arbitrary
21+
SQL conditions, enabling mass data modification, mass data deletion,
22+
and information disclosure via boolean-based exfiltration.
23+
patched_versions:
24+
- ">= 2.7.0"
25+
related:
26+
url:
27+
- https://rubygems.org/gems/activity_notification/versions/2.7.0
28+
- https://github.com/simukappu/activity_notification/compare/v2.6.1...v2.7.0
29+
- https://github.com/simukappu/activity_notification/security/advisories/GHSA-h5xx-m7vj-5vg2
30+
notes: |
31+
- Project GHSA has "Critical" severity, but no CVE or cvss values.
32+
- date value from rubygems.org URL
33+
---

‎advisories/_posts/2026-07-20-GHSA-4825-p4xm-pcf2.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-4825-p4xm-pcf2 (spree_api): Broken Access Control in `PATCH /api/v3/store/carts/:id/associate`
4+
(IDOR)'
5+
comments: false
6+
categories:
7+
- spree_api
8+
advisory:
9+
gem: spree_api
10+
ghsa: 4825-p4xm-pcf2
11+
url: https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
12+
title: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
13+
date: 2026-07-20
14+
description: |-
15+
## Summary
16+
17+
The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds
18+
a guest cart to the authenticated caller without verifying possession
19+
of that cart. It locates the cart by prefixed ID only —
20+
current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(
21+
params[:id]) — and omits the authorize!(:update, @cart, cart_token)
22+
check that every other action in the controller performs via CartResolvable.
23+
Because prefixed IDs are a reversible Sqids encoding of the auto-increment
24+
primary key (obfuscation, not a token), an authenticated customer can
25+
name arbitrary guest cart IDs, take them over, and read the checkout
26+
addresses stored on them. This is broken access control / IDOR,
27+
reachable by any low-privilege registered user.
28+
29+
## Severity
30+
31+
Requires an authenticated store account and depends on target guest
32+
carts already carrying an address and not yet being associated, on a
33+
store not running in login_required mode. Confidentiality impact is
34+
the driver (guest checkout PII); integrity impact is limited and
35+
recoverable (cart reassignment + email overwrite on an in-progress
36+
cart). Not Critical: the action is gated behind authentication (PR:L, not
37+
PR:N) and constrained by cart state, so it is not anonymously exploitable.
38+
39+
## Impact
40+
41+
Confidentiality: an authenticated attacker can enumerate guest cart
42+
IDs and read checkout PII (name, street, postal code, phone) on carts
43+
they don't own. Integrity: limited and recoverable — each call reassigns
44+
the guest cart and overwrites its email, disrupting the original
45+
guest's in-progress cart. Requires a registered account, so not
46+
anonymously exploitable.
47+
48+
## Remediation
49+
50+
Update to Spree 5.4.4 or 5.5.4.
51+
52+
Your storefront, based on https://github.com/spree/storefront,
53+
doesn't need any updates because it has always sent a cart
54+
token when associating carts; this is a backend issue.
55+
cvss_v3: 7.1
56+
unaffected_versions:
57+
- "< 5.4.0"
58+
patched_versions:
59+
- "~> 5.4.4"
60+
- ">= 5.5.4"
61+
related:
62+
url:
63+
- https://rubygems.org/gems/spree_api/versions/5.5.4 - https://github.com/spree/spree/releases/tag/v5.5.4
64+
- https://rubygems.org/gems/spree_api/versions/5.4.4 - https://github.com/spree/spree/releases/tag/v5.4.4
65+
- https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
66+
notes: |
67+
- NOTE: Gem name is "spree_api" but repo name is "spree".
68+
- cvss_v3 from project GHSA
69+
- No CVE in project GHSA
70+
- date field is rubygems.org release date.
71+
---

‎advisories/_posts/2026-07-21-GHSA-j7xr-4g94-r9h3.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-j7xr-4g94-r9h3 (graphql): Authorization Bypass in Execution::Next'
4+
comments: false
5+
categories:
6+
- graphql
7+
advisory:
8+
gem: graphql
9+
ghsa: j7xr-4g94-r9h3
10+
url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-j7xr-4g94-r9h3
11+
title: Authorization Bypass in Execution::Next
12+
date: 2026-07-21
13+
description: |-
14+
## Impact
15+
16+
In GraphQL-Ruby < v2.6.6, when using Execution::Next, authorization
17+
failures did not properly halt execution for fields using
18+
GraphQL::Schema::Resolver (and its subclasses, including
19+
GraphQL::Schema::Mutation, GraphQL::Schema::RelayClassicMutation,
20+
and GraphQL::Schema::Subscription) when they raised
21+
GraphQL::UnauthorizedErrors.
22+
Other forms of authorization were applied correctly.
23+
24+
If your application uses Execution::Next, update
25+
GraphQL-Ruby to v2.6.6 or later.
26+
27+
## Credit
28+
29+
This issue was discovered with the GitHub Security Lab Taskflow Agent
30+
as part of Project Glasswing, a cross-industry initiative to secure
31+
critical open-source software using frontier AI models, and manually
32+
verified by GHSL team member: @anticomputer.
33+
unaffected_versions:
34+
- "< 2.5.23"
35+
patched_versions:
36+
- ">= 2.6.6"
37+
related:
38+
url:
39+
- https://rubygems.org/gems/graphql/versions/2.6.6
40+
- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#266-21-jul-2026
41+
- https://github.com/rmosolgo/graphql-ruby/compare/v2.6.5...v2.6.6
42+
- https://github.com/GitHubSecurityLab/seclab-taskflow-agent
43+
- https://www.anthropic.com/glasswing
44+
- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-j7xr-4g94-r9h3
45+
notes: |
46+
- Note that gem name is "graphql" but repo name is "graphql-ruby".
47+
- Project GHSA has "High" severity.
48+
- No CVE in project GHSA so no cvss values.
49+
- date value from rubygems.org URL.
50+
---

0 commit comments

Comments
 (0)