Merge pull request #1233 from jasnow/new-graphql-advs

Two new graphql-related advisories

@simi - Thanks for reviewing and approving this PR.

Author: jasnow

gems/graphql-c_parser/GHSA-52mm-32rv-3rpg.yml

@@ -0,0 +1,30 @@
+---
+gem: graphql-c_parser
+ghsa: 52mm-32rv-3rpg
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-52mm-32rv-3rpg
+title: Unauthenticated remote use-after-free in graphql-c_parser
+date: 2024-08-03
+description: |
+  Use-after-free is possible graphql-c_parser if Bison moves GraphQL-Ruby
+  AST nodes into the heap. Bison's heap is not scanned by Ruby's garbage
+  collector, so if GC runs during this stage, Ruby determines those
+  objects to be dead. Later, however, graphql-c_parser uses those
+  objects again while continuing to parse.
+
+  Patched versions use Bison's YYSTACK_USE_ALLOCA 1 configuration
+  to use stack memory instead.
+
+  This issue was reported by PlatformSecurity.
+cvss_v3: 9.8
+patched_versions:
+  - ">= 1.1.4"
+related:
+  url:
+    - https://rubygems.org/gems/graphql-c_parser/versions/1.1.4
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/graphql-c_parser/CHANGELOG.md#114
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-52mm-32rv-3rpg
+notes: |
+  - date from rubygems.org URL.
+  - cvss_v3 from GHSA.
+  - No CVE in GHSA url.
+  - Note: gem name is "graphql-c_parser" but repo name is "graphql-ruby".

gems/graphql/GHSA-rmxg-5p3r-j6hh.yml

@@ -0,0 +1,29 @@
+---
+gem: graphql
+ghsa: rmxg-5p3r-j6hh
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+title: Unsafe Marshal deserialization in the parser cache
+       can lead to arbitrary Ruby code execution
+date: 2026-08-17
+description: |
+  GraphQL::Language::Cache#fetch reads parser cache files and passes
+  their contents directly to Marshal.load without authenticating the
+  payloads. If an attacker can place a crafted payload in the expected
+  path and the application calls GraphQL::Language::Parser.parse_file,
+  then attacker-controlled marshal_load or _load methods are executed,
+  resulting in arbitrary Ruby code execution in the application process.
+unaffected_versions:
+  - "< 1.12.6"
+patched_versions:
+  - ">= 2.6.9"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.9
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#269-17-aug-2026
+    - https://github.com/rmosolgo/graphql-ruby/compare/v2.6.8...v2.6.9
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+notes: |
+  - date from rubygems.org URL.
+  - GHSA Severity is "High".
+  - No CVE in GHSA url.
+  - Note: gem name is "graphql" but repo name is "graphql-ruby".