Skip to content

Commit 11a6fb4

Browse files
jasnowjasnow
authored
GHSA/SYNC: 3 more new advisories (#1053)
* GHSA/SYNC: 3 more new advisories * Update CVE-2026-42205.yml for patched versions nvd URL had wrong patched version. Goog catch.
1 parent a1c6e7c commit 11a6fb4

3 files changed

Lines changed: 158 additions & 0 deletions

File tree

‎gems/avo/CVE-2026-42205.yml‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
---
2+
gem: avo
3+
cve: 2026-42205
4+
ghsa: qc5p-3mg5-9fh8
5+
url: https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
6+
title: Broken Access Control Through Unauthorized Execution of Arbitrary
7+
Action Classes Across Resources
8+
date: 2026-04-24
9+
description: |
10+
### Summary
11+
12+
A critical Broken Access Control vulnerability was identified in the
13+
`ActionsController` of the Avo framework (v3.x). Due to insecure
14+
action lookup logic, an authenticated user can execute any Action
15+
class (descendants of `Avo::BaseAction`) on any resource, even if
16+
the action is not registered for that specific resource. This leads
17+
to Privilege Escalation and unauthorized data manipulation across
18+
the entire application.
19+
20+
### Details
21+
22+
The vulnerability exists in the `action_class` method within
23+
`app/controllers/avo/actions_controller.rb`.
24+
25+
#### Vulnerable Code
26+
27+
```ruby
28+
def action_class
29+
# It searches through ALL descendants of BaseAction without
30+
# resource validation.
31+
Avo::BaseAction.descendants.find do |action|
32+
action.to_s == params[:action_id]
33+
end
34+
end
35+
```
36+
37+
The controller identifies the action class to execute solely based
38+
on the `params[:action_id]` by searching through all `BaseAction`
39+
descendants. It fails to verify whether the requested action is
40+
actually permitted or registered for the resource context specified
41+
in the request URL (e.g., `/admin/resources/posts/actions`).
42+
43+
Consequently, an attacker can invoke sensitive actions (e.g.,
44+
`Avo::Actions::ToggleAdmin`) through an unrelated resource endpoint
45+
(e.g., `Post`), bypassing the intended resource-action mapping.
46+
47+
### Impact
48+
49+
This flaw results in significant security risks:
50+
51+
- **Privilege Escalation:** An authenticated user with low privileges
52+
can execute administrative actions (like toggling admin roles) to
53+
escalate their own or others' permissions.
54+
- **Unauthorized Operations:** Actions designed for restricted
55+
resources can be triggered against any record ID in the database.
56+
- **Data Integrity Compromise:** Attackers can perform unauthorized
57+
destructive operations (e.g., Delete, Archive, or Update) on records
58+
they should not have access to.
59+
60+
### CREDIT
61+
62+
Illunight
63+
cvss_v3: 8.8
64+
patched_versions:
65+
- ">= 3.31.1"
66+
related:
67+
url:
68+
- https://nvd.nist.gov/vuln/detail/CVE-2026-42205
69+
- https://github.com/avo-hq/avo/releases/tag/v3.31.1
70+
- https://github.com/avo-hq/avo/security/advisories/GHSA-qc5p-3mg5-9fh8
71+
- https://github.com/advisories/GHSA-qc5p-3mg5-9fh8

‎gems/css_parser/CVE-2026-44312.yml‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
gem: css_parser
3+
cve: 2026-44312
4+
ghsa: ff6c-w6qf-7xqc
5+
url: https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc
6+
title: Improper Certificate Validation allows MITM injection of remote
7+
CSS content
8+
date: 2026-05-07
9+
description: |
10+
### Summary
11+
12+
The CSS Parser gem does not validate HTTPS connections, allowing a
13+
Man-in-the-Middle (MITM) attacker to inject or modify CSS content when
14+
stylesheets are loaded via HTTPS. The connection is established with
15+
`OpenSSL::SSL::VERIFY_NONE`, meaning any HTTPS certificate—even
16+
entirely untrusted—will be accepted without validation.
17+
18+
### Details
19+
20+
In `lib/css_parser/parser.rb`, the HTTP client sets:
21+
https://github.com/premailer/css_parser/blob/3f91e8db7547fac50ab50cb7f9920f785f722740/lib/css_parser/parser.rb#L646
22+
23+
```ruby
24+
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
25+
```
26+
27+
As a result, the library does not validate the authenticity of HTTPS
28+
connections and does not protect against man-in-the-middle attacks.
29+
Any attacker in a position to intercept network traffic can inject
30+
or modify CSS loaded via HTTPS URLs without detection or warning.
31+
32+
### Impact
33+
34+
Applications using CSS Parser to load remote stylesheets over HTTPS
35+
are vulnerable to CSS injection and content manipulation, regardless
36+
of the trust status of the remote server. All users who use CSS Parser
37+
to fetch external CSS over HTTPS may be impacted.
38+
39+
### Credit
40+
41+
This vulnerability was uncovered by @JLLeitschuh of the
42+
@braze-inc security team.
43+
cvss_v3: 5.8
44+
patched_versions:
45+
- "~> 1.22.0"
46+
- ">= 2.1.0"
47+
related:
48+
url:
49+
- https://nvd.nist.gov/vuln/detail/CVE-2026-44312
50+
- https://github.com/premailer/css_parser/security/advisories/GHSA-ff6c-w6qf-7xqc
51+
- https://github.com/premailer/css_parser/commit/35e689c904225add78e0c488cf04bad052666449
52+
- https://github.com/premailer/css_parser/commit/e0c95d5abe91b237becb90ff316531a6547ada18
53+
- https://github.com/premailer/css_parser/issues/185
54+
- https://github.com/advisories/GHSA-ff6c-w6qf-7xqc

‎gems/graphql/GHSA-3h96-34p3-xm76.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
gem: graphql
3+
ghsa: 3h96-34p3-xm76
4+
url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
5+
title: GraphQL-Ruby's Ruby lexer does not count comment tokens for
6+
the purposes of max_query_string_tokens
7+
date: 2026-05-05
8+
description: |
9+
GraphQL-Ruby's `max_query_string_tokens` configuration didn't count
10+
comment tokens against the limit, allowing strings to be processed
11+
even after the configured maximum had actually been reached.
12+
13+
In patched versions, the Ruby lexer does count these tokens.
14+
15+
GraphQL-CParser is not affected by this problem.
16+
17+
`max_query_string_tokens` was introduced in v2.3.1. Each 2.x
18+
version has received a new patch release for including a fix.
19+
cvss_v3: 5.3
20+
unaffected_versions:
21+
- "< 2.3.1"
22+
patched_versions:
23+
- "~> 2.3.23"
24+
- "~> 2.4.18"
25+
- "~> 2.5.26"
26+
- ">= 2.6.1"
27+
related:
28+
url:
29+
- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#261
30+
- https://github.com/rmosolgo/graphql-ruby/commit/2a8d95680bf1ed9bb7c0d89345a736f57b10877b
31+
- https://github.com/rmosolgo/graphql-ruby/pull/4929
32+
- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-3h96-34p3-xm76
33+
- https://github.com/advisories/GHSA-3h96-34p3-xm76

0 commit comments

Comments
 (0)