From 68c35283172234ed73660a245bf8779a7038a2ce Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 25 Jun 2026 21:19:01 -0400 Subject: [PATCH 1/2] Four new advisories --- gems/css_parser/CVE-2026-53727.yml | 35 ++++++++++++++ gems/msgpack/CVE-2026-54522.yml | 30 ++++++++++++ gems/savon/CVE-2026-53510.yml | 30 ++++++++++++ gems/secure_headers/CVE-2026-54163.yml | 65 ++++++++++++++++++++++++++ 4 files changed, 160 insertions(+) create mode 100644 gems/css_parser/CVE-2026-53727.yml create mode 100644 gems/msgpack/CVE-2026-54522.yml create mode 100644 gems/savon/CVE-2026-53510.yml create mode 100644 gems/secure_headers/CVE-2026-54163.yml diff --git a/gems/css_parser/CVE-2026-53727.yml b/gems/css_parser/CVE-2026-53727.yml new file mode 100644 index 0000000000..8ce4b67245 --- /dev/null +++ b/gems/css_parser/CVE-2026-53727.yml @@ -0,0 +1,35 @@ +--- +gem: css_parser +cve: 2026-53727 +ghsa: 9pmc-p236-855h +url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727 +title: SSRF and Local File Disclosure in `CssParser::Parser#read_remote_file` +date: 2026-06-01 +description: | + ## Summary + + CssParser::Parser#read_remote_file (and therefore load_uri!, and the + @import-following branch of add_block!) issues HTTP/HTTPS requests + against any host, port and URI it is handed, with no scheme allowlist, + no host / IP filtering, and no protection against link-local, loopback + or RFC‑1918 addresses. Location: redirects are followed recursively + back into the same function, which also services file:// URIs, so a + single attacker-controlled HTTP redirect upgrades the bug from SSRF + to arbitrary local file disclosure. + + In practice, any consumer of css_parser that hands it attacker‑influenced + CSS together with a base_uri: option — Premailer being the canonical + example — is exposed. The attacker only needs the ability to land one + @import url(...) in the CSS that the host application parses. +unaffected_versions: + - "< 2.2.0" +patched_versions: + - ">= 3.0.0" +related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53727 + - https://rubygems.org/gems/css_parser/versions/3.0.0 + - https://github.com/premailer/css_parser/blob/master/CHANGELOG.md#version-300 + - https://github.com/premailer/css_parser/security/advisories/GHSA-9pmc-p236-855h +notes: | + - CVE is reserved, but published so no cvss values. diff --git a/gems/msgpack/CVE-2026-54522.yml b/gems/msgpack/CVE-2026-54522.yml new file mode 100644 index 0000000000..16f7b2a26e --- /dev/null +++ b/gems/msgpack/CVE-2026-54522.yml @@ -0,0 +1,30 @@ +--- +gem: msgpack +cve: 2026-54522 +ghsa: 4mrv-5p47-p938 +url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522 +title: DFVULN-839 - Use-After-Free in MessagePack::Buffer#clear + Enables Cross-Buffer Disclosure +date: 2026-06-10 +description: | + ## Summary + + MessagePack::Buffer#clear shifts out every chunk and returns its + 4 KiB rmem page to the shared pool, but does not reset the buffer's + rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees + "unused rmem space" left over from the freed page and hands back a + slice of memory that has already been returned to the pool. A second + MessagePack::Buffer then re-acquires that same page, so reading the + cleared-and-rewritten buffer discloses the second buffer's bytes — a + same-process use-after-free with cross-buffer information + disclosure (and the symmetric write-corruption). +patched_versions: + - ">= 1.8.2" +related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522 + - https://github.com/msgpack/msgpack-ruby/blob/master/ChangeLog + - https://github.com/msgpack/msgpack-ruby/compare/v1.8.1...v1.8.2 + - https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938 +notes: | + - CVE is reserved, but published so no cvss values. diff --git a/gems/savon/CVE-2026-53510.yml b/gems/savon/CVE-2026-53510.yml new file mode 100644 index 0000000000..94f276d27a --- /dev/null +++ b/gems/savon/CVE-2026-53510.yml @@ -0,0 +1,30 @@ +--- +gem: savon +cve: 2026-53510 +url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510 +title: Fix Savon::HTTPError compatibility with Faraday transport +date: 2026-06-23 +description: | + Savon::Model generated SOAP operation methods by interpolating + operation names into Ruby source passed to module_eval. An attacker + who can control the operation names of a WSDL, can inject Ruby code + that executes in the application process. This affects only the + .all_operations class method provided by Savon::Model to automatically + register all operations provided by the WSDL. Configuring Savon::Model + with trusted operation names via .operations is safe. + + Thanks to @connorshea for securely disclosing this, providing + a proof and a great report. +patched_versions: + - ">= 2.17.2" +related: + url: + - https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-53510 + - https://github.com/savonrb/savon/releases/tag/v2.17.2 + - https://github.com/savonrb/savon/blob/main/CHANGELOG.md#2172---2026-06-10 + - https://github.com/savonrb/savon/blob/v2.17.1/lib/savon/model.rb#L30-L45 + - https://gist.github.com/connorshea/6cdc951abe0e1ffd2d1cc0fa7cd6b74d + - https://github.com/savonrb/savon/security/advisories/GHSA-mx5j-mp4f-g8jg +notes: | + - Found CVE # in CHANGELOG file. + - CVE is reserved, but published so no cvss values. diff --git a/gems/secure_headers/CVE-2026-54163.yml b/gems/secure_headers/CVE-2026-54163.yml new file mode 100644 index 0000000000..448a1ac229 --- /dev/null +++ b/gems/secure_headers/CVE-2026-54163.yml @@ -0,0 +1,65 @@ +--- +gem: secure_headers +cve: 2026-54163 +ghsa: rqq5-2gf9-4w4q +url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54163 +title: CSP directive injection via sandbox, plugin_types, and report_to + when given untrusted input +date: 2026-06-3 +description: | + ## Summary + + secure_headers builds the Content-Security-Policy value by stitching + every configured directive together with ; separators. Three directive + builders (build_sandbox_list_directive, build_media_type_list_directive, + build_report_to_directive) interpolate caller-supplied strings into + that value without scrubbing ;, \r, or \n. + + When an application forwards untrusted input into + SecureHeaders.override_content_security_policy_directives (or append_…) + for :sandbox, :plugin_types, or :report_to, an attacker can embed a + literal ; and inject an arbitrary CSP directive into the header value. + Because :sandbox and :plugin_types both sort alphabetically before + :script_src in BODY_DIRECTIVES, the injected script-src lands earlier + in the header and wins under the CSP first-occurrence rule, defeating + the application's real script-src. End result: an 'unsafe-inline' * policy + is forced for inline