Threats affecting pkg:gem/shirasagi

CVE-2026-118869 is an OS command injection vulnerability in SHIRASAGI versions 1.19.0 through 1.21.0. It allows an authenticated attacker to execute arbitrary operating system commands on the affected system without user interaction. The vulnerability has a high severity score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.

CVE-2026-117679 is a cross-site scripting (XSS) vulnerability in the SHIRASAGI project that affects versions from 1.12.0 through 1.21.0. This vulnerability allows an authenticated attacker to execute arbitrary scripts in the web browser of users who access a website using the affected SHIRASAGI versions.