Skip to content

Commit 406c4d5

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@11a6fb4 
1 parent 39fc4e5 commit 406c4d5

3 files changed

Lines changed: 181 additions & 0 deletions

File tree

‎advisories/_posts/2026-04-24-CVE-2026-42205.md‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-42205 (avo): Broken Access Control Through Unauthorized Execution
4+
of Arbitrary Action Classes Across Resources'
5+
comments: false
6+
categories:
7+
- avo
8+
advisory:
9+
gem: avo
10+
cve: 2026-42205
11+
ghsa: qc5p-3mg5-9fh8
12+
url: https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
13+
title: Broken Access Control Through Unauthorized Execution of Arbitrary Action
14+
Classes Across Resources
15+
date: 2026-04-24
16+
description: |-
17+
### Summary
18+
19+
A critical Broken Access Control vulnerability was identified in the
20+
`ActionsController` of the Avo framework (v3.x). Due to insecure
21+
action lookup logic, an authenticated user can execute any Action
22+
class (descendants of `Avo::BaseAction`) on any resource, even if
23+
the action is not registered for that specific resource. This leads
24+
to Privilege Escalation and unauthorized data manipulation across
25+
the entire application.
26+
27+
### Details
28+
29+
The vulnerability exists in the `action_class` method within
30+
`app/controllers/avo/actions_controller.rb`.
31+
32+
#### Vulnerable Code
33+
34+
```ruby
35+
def action_class
36+
# It searches through ALL descendants of BaseAction without
37+
# resource validation.
38+
Avo::BaseAction.descendants.find do |action|
39+
action.to_s == params[:action_id]
40+
end
41+
end
42+
```
43+
44+
The controller identifies the action class to execute solely based
45+
on the `params[:action_id]` by searching through all `BaseAction`
46+
descendants. It fails to verify whether the requested action is
47+
actually permitted or registered for the resource context specified
48+
in the request URL (e.g., `/admin/resources/posts/actions`).
49+
50+
Consequently, an attacker can invoke sensitive actions (e.g.,
51+
`Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint
52+
(e.g., `Post`), bypassing the intended resource-action mapping.
53+
54+
### Impact
55+
56+
This flaw results in significant security risks:
57+
58+
- **Privilege Escalation:** An authenticated user with low privileges
59+
can execute administrative actions (like toggling admin roles) to
60+
escalate their own or others' permissions.
61+
- **Unauthorized Operations:** Actions designed for restricted
62+
resources can be triggered against any record ID in the database.
63+
- **Data Integrity Compromise:** Attackers can perform unauthorized
64+
destructive operations (e.g., Delete, Archive, or Update) on records
65+
they should not have access to.
66+
67+
### CREDIT
68+
69+
Illunight
70+
cvss_v3: 8.8
71+
patched_versions:
72+
- ">= 3.31.1"
73+
related:
74+
url:
75+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42205
76+
- https://github.com/avo-hq/avo/releases/tag/v3.31.1
77+
- https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
78+
- https://github.com/advisories/GHSA-qc5p-3mg5-9fh8
79+
---

‎advisories/_posts/2026-05-05-GHSA-3h96-34p3-xm76.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
layout: advisory
3+
title: 'GHSA-3h96-34p3-xm76 (graphql): GraphQL-Ruby''s Ruby lexer does not count comment
4+
tokens for the purposes of max_query_string_tokens'
5+
comments: false
6+
categories:
7+
- graphql
8+
advisory:
9+
gem: graphql
10+
ghsa: 3h96-34p3-xm76
11+
url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
12+
title: GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes
13+
of max_query_string_tokens
14+
date: 2026-05-05
15+
description: |-
16+
GraphQL-Ruby's `max_query_string_tokens` configuration didn't count
17+
comment tokens against the limit, allowing strings to be processed
18+
even after the configured maximum had actually been reached.
19+
20+
In patched versions, the Ruby lexer does count these tokens.
21+
22+
GraphQL-CParser is not affected by this problem.
23+
24+
`max_query_string_tokens` was introduced in v2.3.1. Each 2.x
25+
version has received a new patch release for including a fix.
26+
cvss_v3: 5.3
27+
unaffected_versions:
28+
- "< 2.3.1"
29+
patched_versions:
30+
- "~> 2.3.23"
31+
- "~> 2.4.18"
32+
- "~> 2.5.26"
33+
- ">= 2.6.1"
34+
related:
35+
url:
36+
- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#261
37+
- https://github.com/rmosolgo/graphql-ruby/commit/2a8d95680bf1ed9bb7c0d89345a736f57b10877b
38+
- https://github.com/rmosolgo/graphql-ruby/pull/4929
39+
- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
40+
- https://github.com/advisories/GHSA-3h96-34p3-xm76
41+
---

‎advisories/_posts/2026-05-07-CVE-2026-44312.md‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2026-44312 (css_parser): Improper Certificate Validation allows MITM injection
4+
of remote CSS content'
5+
comments: false
6+
categories:
7+
- css_parser
8+
advisory:
9+
gem: css_parser
10+
cve: 2026-44312
11+
ghsa: ff6c-w6qf-7xqc
12+
url: https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc
13+
title: Improper Certificate Validation allows MITM injection of remote CSS content
14+
date: 2026-05-07
15+
description: |-
16+
### Summary
17+
18+
The CSS Parser gem does not validate HTTPS connections, allowing a
19+
Man-in-the-Middle (MITM) attacker to inject or modify CSS content when
20+
stylesheets are loaded via HTTPS. The connection is established with
21+
`OpenSSL::SSL::VERIFY_NONE`, meaning any HTTPS certificate—even
22+
entirely untrusted—will be accepted without validation.
23+
24+
### Details
25+
26+
In `lib/css_parser/parser.rb`, the HTTP client sets:
27+
https://github.com/premailer/css_parser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/css_parser/parser.rb#L646
28+
29+
```ruby
30+
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
31+
```
32+
33+
As a result, the library does not validate the authenticity of HTTPS
34+
connections and does not protect against man-in-the-middle attacks.
35+
Any attacker in a position to intercept network traffic can inject
36+
or modify CSS loaded via HTTPS URLs without detection or warning.
37+
38+
### Impact
39+
40+
Applications using CSS Parser to load remote stylesheets over HTTPS
41+
are vulnerable to CSS injection and content manipulation, regardless
42+
of the trust status of the remote server. All users who use CSS Parser
43+
to fetch external CSS over HTTPS may be impacted.
44+
45+
### Credit
46+
47+
This vulnerability was uncovered by @JLLeitschuh of the
48+
@braze-inc security team.
49+
cvss_v3: 5.8
50+
patched_versions:
51+
- "~> 1.22.0"
52+
- ">= 2.1.0"
53+
related:
54+
url:
55+
- https://nvd.nist.gov/vuln/detail/CVE-2026-44312
56+
- https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc
57+
- https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449
58+
- https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18
59+
- https://github.com/premailer/css_parser/issues/185
60+
- https://github.com/advisories/GHSA-ff6c-w6qf-7xqc
61+
---

0 commit comments

Comments
 (0)