Skip to content

Commit cc6d3e4

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@4a871d6 
1 parent 3896238 commit cc6d3e4

6 files changed

Lines changed: 296 additions & 3 deletions

‎advisories/_posts/2026-06-07-CVE-2026-54603.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54603 (oauth2): OAuth2::Client#request: Protocol-relative redirect
4+
Location overrides authority, leaking bearer Authorization to attacker host'
5+
comments: false
6+
categories:
7+
- oauth2
8+
advisory:
9+
gem: oauth2
10+
cve: 2026-54603
11+
ghsa: pp92-crg2-gfv9
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-54603
13+
title: 'OAuth2::Client#request: Protocol-relative redirect Location overrides authority,
14+
leaking bearer Authorization to attacker host'
15+
date: 2026-06-07
16+
description: |-
17+
## Summary
18+
19+
When an application uses OAuth2::Client (typically via an
20+
OAuth2::AccessToken) and the configured authorization server returns
21+
a redirect whose Location header is a protocol-relative URI of the
22+
form //attacker.example/leak, OAuth2::Client#request resolves the
23+
redirect with response.response.env.url.merge(location). Per
24+
RFC 3986 §5.2, an input that starts with // is a network-path reference
25+
and replaces the authority of the base URL:
26+
URI("http://idp.trusted/userinfo").merge("//attacker.example/leak")
27+
returns http://attacker.example/leak. The recursive request(verb,
28+
full_location, req_opts) call then re-sends the request to the attacker
29+
host while preserving the Authorization: Bearer <access-token> header
30+
that OAuth2::AccessToken#configure_authentication! installed on
31+
req_opts[:headers] for the original request.
32+
33+
The result is a one-shot cross-origin credential disclosure: any 30x
34+
response from the IdP that an attacker can influence (a compromised
35+
endpoint, a tenant-controlled IdP in a multi-tenant deployment, or an
36+
open-redirect handler that does not normalise the Location it emits)
37+
can extract the bearer access token of the calling user.
38+
39+
## Affected
40+
41+
* oauth2 v2.0.21 and all prior versions back to and including v0.4.0.
42+
* The underlying unsafe redirect-following behavior that
43+
reuses headers starts in v0.4.0 via b944da5.
44+
* The vulnerability was retained when the code was refactored
45+
to a redirect helper, and in this form has been present in
46+
OAuth2::Client#request since v2.0.0 via b944da5.
47+
* Ruby 4.0.5 on arm64-darwin25. The behaviour of URI#merge for
48+
protocol-relative inputs is RFC-conformant and the same on every
49+
supported Ruby (≥ 2.x).
50+
* Adapter independence: confirmed against the default faraday 2.14.2 +
51+
faraday-net_http 3.4.3 stack. The URI#merge call is in oauth2
52+
itself, not in Faraday, so the issue is not adapter-specific.
53+
54+
## Impact
55+
56+
A consumer that uses OAuth2::AccessToken#get / #post / #request
57+
against an IdP whose redirect target an attacker can influence (open
58+
redirect, malicious tenant, or in-path adversary) loses two things at once:
59+
60+
1. Cross-origin credential disclosure. The connection-scoped
61+
Authorization: Bearer <token> header attached by
62+
OAuth2::AccessToken#configure_authentication! is sent to the
63+
attacker host on the very next request, with no second user interaction.
64+
2. SSRF from the application server. The OAuth2 client follows the
65+
redirect on behalf of the application, so the host that ultimately
66+
receives the request is one the attacker chooses — useful for
67+
hitting internal addresses (//169.254.169.254/..., //127.0.0.1:.../...)
68+
that the application server can reach but the attacker cannot.
69+
70+
The combined primitive is stronger than the usual cross-origin-redirect
71+
leak because no application-level cooperation is required and no
72+
Location: http://attacker/... is needed — the protocol-relative
73+
//attacker/x form slips past naive scheme-based Location filters
74+
that allow same-scheme-implicit redirects.
75+
76+
## Credit
77+
78+
* Reported by tonghuaroot.
79+
cvss_v3: 8.6
80+
unaffected_versions:
81+
- "< 0.4.0"
82+
patched_versions:
83+
- ">= 2.0.22"
84+
related:
85+
url:
86+
- https://nvd.nist.gov/vuln/detail/CVE-2026-54603
87+
- https://github.com/ruby-oauth/oauth2/releases/tag/v2.0.22
88+
- https://github.com/ruby-oauth/oauth2/blob/v2.0.22/CHANGELOG.md
89+
- https://github.com/ruby-oauth/oauth2/commit/0f0a474f1b38453e119e660c2daca742d4378ce9
90+
- https://github.com/ruby-oauth/oauth2/commit/442c1609858ebaecbac5eab77f4511bc81ed7383
91+
- https://advisories.gitlab.com/gem/oauth2/CVE-2026-54603
92+
- https://github.com/ruby-oauth/oauth2/security/advisories/GHSA-pp92-crg2-gfv9
93+
- https://github.com/advisories/GHSA-pp92-crg2-gfv9
94+
notes: "- cvss_v3 from GHSA\n"
95+
---

‎advisories/_posts/2026-06-07-CVE-2026-54605.md‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54605 (oauth): Cross-origin OAuth token-request redirects can expose
4+
signed request metadata'
5+
comments: false
6+
categories:
7+
- oauth
8+
advisory:
9+
gem: oauth
10+
cve: 2026-54605
11+
ghsa: prq8-7wvh-44qh
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-54605
13+
title: Cross-origin OAuth token-request redirects can expose signed request metadata
14+
date: 2026-06-07
15+
description: |-
16+
## Summary
17+
18+
When an application uses OAuth::Consumer to request OAuth 1.0 request
19+
tokens or access tokens, the token request helper follows 300..399
20+
redirects returned by the OAuth server. In affected versions,
21+
OAuth::Consumer#token_request parses the raw Location header, follows
22+
the redirect recursively, and can mutate the consumer's configured
23+
site when the redirect points to a different host with the same path.
24+
25+
The result is a cross-origin signed-request disclosure primitive: if an OAuth
26+
server token endpoint returns a redirect whose target an attacker controls,
27+
the client can re-sign the token request and send OAuth 1.0 request metadata,
28+
including the OAuth signature, nonce, timestamp, consumer key, and any request
29+
parameters included in the signature base string, to the attacker-controlled
30+
host. The same behavior can also be used as an SSRF or confused-deputy
31+
primitive because the application server follows the redirect and sends
32+
the next request from its own network position.
33+
34+
## Affected
35+
36+
oauth v1.1.5 and prior versions back to and including v0.5.5.
37+
The cross-host token redirect behavior was introduced by d74b767f
38+
The behavior is documented in the v0.5.5 changelog as "Allow redirect to
39+
different host but same path".
40+
The vulnerable behavior is in OAuth::Consumer#token_request, which is
41+
used by the documented request-token and access-token flows.
42+
The issue is not specific to a Ruby engine or platform. It is caused by the
43+
gem's redirect handling and recursive token request behavior.
44+
Patched version: oauth v1.1.6.
45+
46+
## Impact
47+
48+
A consumer that calls OAuth::Consumer#get_request_token,
49+
OAuth::Consumer#get_access_token, or lower-level token request helpers
50+
against an OAuth server whose token endpoint redirect target can be
51+
influenced may lose three security properties:
52+
53+
Cross-origin signed-request metadata disclosure. The redirected request is
54+
signed for the attacker-controlled endpoint. Depending on the request method,
55+
scheme, and parameters, the attacker may receive OAuth 1.0 parameters such as
56+
oauth_consumer_key, oauth_signature_method, oauth_timestamp,
57+
oauth_nonce, oauth_version, and oauth_signature.
58+
SSRF from the application server. The OAuth client follows the redirect on
59+
behalf of the application, so the redirected host is contacted from the
60+
application server's network position.
61+
Confused-deputy behavior. A malicious or compromised token endpoint can
62+
cause an otherwise trusted application to initiate signed requests to an
63+
unintended origin.
64+
The disclosed OAuth 1 signature is not equivalent to an OAuth 2 bearer token:
65+
it is bound to the signed request, timestamp, nonce, HTTP method, and request
66+
URL. However, it can still disclose sensitive integration metadata, may be
67+
replayable within the receiver's accepted nonce/timestamp window in some
68+
deployments, and can expose application-server reachability to
69+
attacker-selected hosts.
70+
71+
## Credit
72+
73+
* Found during the follow-up audit for GHSA-pp92-crg2-gfv9.
74+
75+
* Reporter/coordinator: Peter H. Boling (pboling)
76+
cvss_v3: 7.2
77+
unaffected_versions:
78+
- "< 0.5.5"
79+
patched_versions:
80+
- ">= 1.1.6"
81+
related:
82+
url:
83+
- https://nvd.nist.gov/vuln/detail/CVE-2026-54605
84+
- https://github.com/ruby-oauth/oauth/blob/v1.1.6/CHANGELOG.md
85+
- https://github.com/ruby-oauth/oauth/releases/tag/v1.1.6
86+
- https://github.com/ruby-oauth/oauth/commit/d74b767f
87+
- https://github.com/ruby-oauth/oauth/commit/d069dc8c4c9631947451215f07460d6cdf0caf3f
88+
- https://github.com/ruby-oauth/oauth/commit/d74b767f
89+
- https://github.com/ruby-oauth/oauth/security/advisories/GHSA-pp92-crg2-gfv9
90+
- https://github.com/ruby-oauth/oauth/security/advisories/GHSA-prq8-7wvh-44qh
91+
- https://github.com/advisories/GHSA-prq8-7wvh-44qh
92+
notes: |
93+
- cvss_v3 from GHSA
94+
- pp92-crg2-gfv9
95+
---

‎advisories/_posts/2026-06-07-CVE-2026-54619.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,19 +26,19 @@ advisory:
2626
reliably triggered after GC when code is structured in a particular way.
2727
There is no known general exploit that could be used as a denial
2828
of service attack.
29-
unaffected_versions:
30-
- "< 2.1.0"
29+
cvss_v4: 2.0
3130
patched_versions:
3231
- ">= 2.9.5"
3332
related:
3433
url:
3534
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619
35+
- https://advisories.gitlab.com/gem/sqlite3/CVE-2026-54619
3636
- https://rubygems.org/gems/sqlite3/versions/2.9.5
3737
- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
3838
- https://github.com/sparklemotion/sqlite3-ruby/pull/711
3939
- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-28hh-pr2h-2w89
4040
notes: |
4141
- NOTE: The gem name is "sqlite3", not the repo name "sqlite3-ruby".
4242
- CVE is reserved, but not published so GHSA Security is
43-
low and no non-GHSA cvss values.
43+
low. cvss_v4 from cve.org URL.
4444
---

‎advisories/_posts/2026-06-07-CVE-2026-54620.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,15 @@ advisory:
2626
reliably triggered after GC when code is structured in a particular way.
2727
There is no known general exploit that could be used as a denial
2828
of service attack.
29+
cvss_v4: 2.0
30+
unaffected_versions:
31+
- "< 2.1.0"
2932
patched_versions:
3033
- ">= 2.9.5"
3134
related:
3235
url:
3336
- https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54620
37+
- https://advisories.gitlab.com/gem/sqlite3/CVE-2026-54620
3438
- https://rubygems.org/gems/sqlite3/versions/2.9.5
3539
- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.5
3640
- https://github.com/sparklemotion/sqlite3-ruby/pull/711

‎advisories/_posts/2026-07-28-CVE-2026-54659.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-54659 (pagy): Pagy I18n locale option is not validated before being
4+
used in a file path'
5+
comments: false
6+
categories:
7+
- pagy
8+
advisory:
9+
gem: pagy
10+
cve: 2026-54659
11+
ghsa: 2xmw-f8j8-wfxc
12+
url: https://nvd.nist.gov/vuln/detail/CVE-2026-54659
13+
title: Pagy I18n locale option is not validated before being used in a file path
14+
date: 2026-07-28
15+
description: |-
16+
### Summary
17+
18+
`Pagy::I18n.locale=` did not validate its argument before using it as a
19+
path component to load the matching dictionary file (`<locale>.yml`). An
20+
application that assigns untrusted input to the locale — e.g. the common
21+
pattern `Pagy::I18n.locale = params[:locale]` — let that input influence
22+
which file Pagy attempted to load.
23+
24+
### Impact
25+
26+
Information disclosure (CWE-22 / CWE-200): a file-existence / readability
27+
oracle for `.yml` paths on the host, plus a server-side read of
28+
attacker-chosen files into the process. The file contents are not
29+
returned in the response.
30+
31+
Only applications that pass **unsanitized end-user input** into
32+
`Pagy::I18n.locale=` are affected. Applications that set the locale from
33+
trusted values are not affected.
34+
cvss_v4: 6.9
35+
unaffected_versions:
36+
- "< 43.0.0"
37+
patched_versions:
38+
- ">= 43.5.6"
39+
related:
40+
url:
41+
- https://nvd.nist.gov/vuln/detail/CVE-2026-54659
42+
- https://github.com/ddnexus/pagy/releases/tag/43.5.6
43+
- https://github.com/ddnexus/pagy/pull/908
44+
- https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df
45+
- https://advisories.gitlab.com/gem/pagy/CVE-2026-54659
46+
- https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc
47+
- https://github.com/advisories/GHSA-2xmw-f8j8-wfxc
48+
notes: "- cvss_v4 from GHSA\n"
49+
---

‎advisories/_posts/2026-07-29-GHSA-pmwx-rm49-xv39.md‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-pmwx-rm49-xv39 (activerecord-tenanted): ActiveRecord::Tenanted::Storage::DiskService#path_for
4+
has a possible path traversal'
5+
comments: false
6+
categories:
7+
- activerecord-tenanted
8+
advisory:
9+
gem: activerecord-tenanted
10+
ghsa: pmwx-rm49-xv39
11+
url: https://github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39
12+
title: ActiveRecord::Tenanted::Storage::DiskService#path_for has a possible path
13+
traversal
14+
date: 2026-07-29
15+
description: |-
16+
### Summary
17+
18+
Active Record Tenanted's override of Active Storage's `DiskService#path_for`
19+
does not validate that the resolved filesystem path remains within
20+
the storage root directory. If a blob key containing path traversal
21+
sequences (e.g. `../`) is used, it could allow reading, writing, or
22+
deleting arbitrary files on the server. Blob keys are expected to be
23+
trusted strings, but some applications could be passing user input
24+
as keys and would be affected.
25+
26+
### Mitigation
27+
28+
Upgrade to Active Record Tenanted v0.7.0 or later.
29+
30+
As a workaround, do not use untrusted user input as blob keys. Blob
31+
keys are expected to be trusted strings.
32+
33+
### Credit
34+
35+
This issue was responsibly reported by @tonghuaroot.
36+
cvss_v4: 2.3
37+
patched_versions:
38+
- ">= 0.7.0"
39+
related:
40+
url:
41+
- https://github.com/basecamp/activerecord-tenanted/security/advisories/GHSA-pmwx-rm49-xv39
42+
- https://github.com/basecamp/activerecord-tenanted/releases/tag/v0.7.0
43+
- https://github.com/basecamp/activerecord-tenanted/pull/307
44+
- https://github.com/basecamp/activerecord-tenanted/commit/b242c8ad9bf58bbd7f5a032d153b0f29db54b9ba
45+
- https://osv.dev/vulnerability/GHSA-pmwx-rm49-xv39
46+
- https://advisories.gitlab.com/gem/activerecord-tenanted/GHSA-pmwx-rm49-xv39
47+
- https://github.com/rails/rails/security/advisories/GHSA-9xrj-h377-fr87
48+
- https://github.com/advisories/GHSA-pmwx-rm49-xv39
49+
notes: "- No CVE in GHSA\n"
50+
---

0 commit comments

Comments
 (0)