A race condition vulnerability exists in the view_component Ruby on Rails framework versions 4.0.0 up to but not including 4.12.0. The issue arises because ViewComponent::Base instances retain render-scoped objects across calls to render_in, causing stale context to be reused across requests or threads. This can lead to unauthorized UI rendering, leaking of request context, and mixing of state between users. The vulnerability is fixed in version 4.12.0.
secure_headers versions prior to 7.3.0 contain a vulnerability where untrusted input can be injected into Content-Security-Policy (CSP) directives without proper sanitization. This improper neutralization allows attackers to insert malicious CSP directives such as script-src 'unsafe-inline', potentially enabling cross-site scripting (XSS) attacks or CSP report exfiltration. The issue is resolved in version 7.3.0.
css_parser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parser#read_remote_file in lib/css_parser/parser.rb, and therefore load_uri! and the @import-following branch of add_block!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering, or protection against link-local, loopback, or RFC-1918 addresses. Location: redirects were followed recursively back into the same function, which also serviced file:// URIs, so a single attacker-controlled HTTP redirect could upgrade the bug from SSRF to arbitrary local file disclosure. Any consumer of css_parser that hands it attacker-influenced CSS together with a base_uri: option is exposed. This issue is fixed in version 3.0.0.
dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value. The extraction path allocates entries while parsing the attacker-controlled header on every request, causing unbounded CPU and memory consumption in an HTTP service where the baggage propagation style is enabled, which is the default for most affected tracers. This can cause denial of service. This issue is fixed in version 2.32.0.
### Impact
If this library is used to implement a WebSocket server on top of a TCP server (rather than an HTTP server or framework) using the `WebSocket::Driver.server()` method, or, if it is used to complement a WebSocket client, then a peer can make a single connection consume an unbounded amount of memory by sending an HTTP request or response with a never-ending list of headers. This can lead to the receiving process running out of memory.
### Patches
The issue has been patched in version 0.8.1, by limiting the total size of HTTP request/response lines and headers accepted by the parser to 32 kB. All users should upgrade to this version.
### Workarounds
No known workarounds exist.
### Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
### Impact
If this library is used in tandem with the `permessage-deflate` extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage.
### Patches
The issue has been patched in version 0.8.1, by checking the length of messages after they are processed by incoming extensions. All users should upgrade to this version.
### Workarounds
No known workarounds exist.
### Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
### Impact
The frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values `0x80` or above, a server or client can make the other peer parse these bytes into an ever-growing integer. Since Ruby integers are arbitrary precision, this can be used to make a WebSocket connection consume an unbounded amount of memory and lead to the host process running out of memory.
### Patches
The issue has been patched in version 0.8.1. All users should upgrade to this version.
### Workarounds
No known workarounds exist.
### Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security Research Team.
Decidim contains a vulnerability in its push-subscription endpoint where an authenticated user can register an attacker-controlled HTTPS URL. When VAPID delivery is enabled, the server sends outbound POST requests to this stored URL, creating a stored, mostly blind server-side request forgery (SSRF) primitive. This allows interaction with arbitrary HTTPS endpoints reachable from the application server, potentially including internal services. The vulnerability affects Decidim versions prior to 0.30.9.
A stored cross-site scripting (XSS) vulnerability exists in Decidim core versions prior to 0.30.9. A privileged admin user who can edit landing pages can inject arbitrary HTML and JavaScript into an HTML content block. This content is rendered without sanitization, allowing script execution in visitors' browsers. Exploitation requires admin-level permissions, reducing practical risk compared to participant-controlled or unauthenticated XSS. A patch is available in Decidim version 0.30.9.
Decidim's CSV census record admin endpoints lack proper authorization checks, allowing participant managers to access and modify census records. This improper access control enables participant managers, who should only manage participants, to create, update, or delete CSV census rows. The vulnerability affects Decidim versions prior to 0.30.9. The issue was identified as broken access control and has been addressed in patches referenced in Decidim's GitHub repository.
Decidim versions prior to 0.31.5 have a vulnerability where JSON Web Tokens (JWTs) issued for one organization can be replayed against another organization's API. This allows unauthorized access to sensitive participant details and mutation paths intended for that other organization. The issue arises because JWT authentication is not sufficiently bound to the host organization context, enabling cross-organization token reuse.
Decidim's verification admin workflow exposes scanned identity-document images through signed URLs that do not require authentication. These URLs remain valid for seven days, allowing anyone with the link to download sensitive verification documents without authorization. This vulnerability affects organizations using the "Identity documents" verification feature and risks leakage of highly sensitive personal information through various channels such as browser history, logs, or support workflows.
Decidim versions prior to 0.30.9 have a vulnerability where private data exports, intended to be accessible only to the export owner, can be downloaded by anyone who obtains the reusable Active Storage blob URL. This URL is exposed via a redirect after an authenticated request and can be replayed without authentication, potentially leaking personal data through various client-side channels.
Decidim-admin versions prior to 0.30.9 contain an SQL injection vulnerability in the admin organization user search feature. The vulnerability arises because user-supplied input is directly interpolated into raw SQL ORDER BY clauses without proper sanitization, allowing authenticated admin users to inject arbitrary SQL expressions. Exploitation requires admin authentication and can be used to perform blind SQL injection via timing attacks, potentially exposing sensitive data accessible to the database role. The vulnerability can also be abused to degrade service availability by causing long-running queries.
A vulnerability in Decidim verification admin functionality allows an admin from one organization to access, approve, or reject identity document verification requests belonging to participants of other organizations. This occurs because the system does not verify that the pending authorization record belongs to the current organization before allowing access and actions. The issue affects Decidim versions prior to 0.30.9. A patch is available as referenced in the Decidim GitHub pull request. As a workaround, disabling the "Identity documents" verification feature can prevent exploitation.
Decidim's demographics questionnaire admin editor lacks proper authorization checks, allowing normal participants to access and modify the admin question editor interface. This vulnerability permits low-privilege users to reach and interact with question-management features that should be restricted to administrators. The issue affects versions 0.31.0 up to but not including 0.31.5 of the decidim-demographics module. A patch is available as referenced in the Decidim GitHub repository. As a workaround, disabling the decidim-demographics module can prevent exploitation.
The Excon RedirectFollower middleware did not properly strip several sensitive headers when following redirects, potentially causing sensitive data to be leaked to unintended targets. This issue affects versions prior to 1.5.0. A patch fixing this vulnerability is available in version 1.5.0.
Avo's direct attachment upload endpoint lacks proper server-side upload authorization, allowing authenticated users with access to the endpoint to upload or replace attachments on records even when field-level upload policies deny such actions. This affects multi-role Avo Pro/Advanced deployments where fine-grained upload restrictions are expected. The vulnerability exists because the upload endpoint creates and attaches files before validating upload permissions, unlike the deletion endpoint which enforces authorization. The issue is confirmed in versions from 2.28.0 up to but not including 3.32.0, with a fix available in 3.32.0.
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, the Fluentd out_http output plugin allows placeholders such as ${tag} in the endpoint configuration parameter, and if a placeholder value is derived from untrusted input an attacker can control the destination hostname of outbound HTTP requests and force requests to arbitrary internal services. This issue is fixed in version 1.19.3.
Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. Prior to 1.19.3, Fluentd's in_http and in_forward plugins support gzip-compressed data but enforce limits only on compressed payloads through settings such as body_size_limit and chunk_size_limit, allowing crafted compressed payloads to decompress in memory to an excessive size and cause denial of service through memory exhaustion. This issue is fixed in version 1.19.3.