CVE-2026-63183 is a host header injection vulnerability in OmniAuth versions prior to 2.2.0. The issue arises when OmniAuth is used with web frameworks that do not validate incoming host headers, potentially allowing an attacker to manipulate host headers. Modern Rails frameworks can mitigate this risk if configured properly. A fix is available in OmniAuth version 2.2.0, and setting the `full_host` configuration in OmniAuth serves as a workaround.
The RubyGem 'control-character-command-injection' version 1.0.1 contains malicious code executed during installation. This code collects sensitive host information including hostname, username, current working directory, home directory, and contents of system files such as /etc/resolv.conf, /etc/passwd, and /etc/hosts. It then sends this data via a TLS connection to an external, unauthorized server. This exfiltration occurs automatically without user interaction.
The RubyGem 'agentic-call-control' version 1.1.8 contains malicious code in its native extension script that executes during installation. This script collects sensitive host information including directory paths, hostname, login name, and contents of system files such as /etc/resolv.conf, /etc/passwd, and /etc/hosts. It then serializes this data as JSON and exfiltrates it over TLS to an attacker-controlled domain. Additionally, it performs a DNS lookup to the same domain as an out-of-band beacon. This behavior is unrelated to any legitimate build or installation process and constitutes unauthorized data harvesting and exfiltration.
The RubyGem 'dynamic-object-handler' version 1.0.1 contains malicious code in its native extension mkrf_conf.rb. During installation, it collects sensitive system information including directory paths, hostname, login name, and contents of critical system files. This data is exfiltrated via a TLS-encrypted POST request to a hardcoded Burp Collaborator subdomain, enabling out-of-band confirmation of code execution even if outbound TCP/443 is blocked.
The donjon-ledger RubyGem version 2.0.2 contains malicious code executed during installation. The gemspec declares a native extension that runs a Ruby script collecting host identifiers and sensitive system files, then exfiltrates this data over a TLS connection to a hardcoded external server. This behavior occurs automatically when the gem is installed, without any legitimate build activity.
The w002yardprobe RubyGem contains malicious code that executes during YARD documentation generation. It runs a script that collects host identifiers and exfiltrates them to a third-party URL. The script also modifies files in the build environment and leaves sentinel files indicating its activity. The malicious behavior triggers when documentation is generated, affecting developer workstations, CI runners, or documentation hosting services that process the gem's docs.
The brida-frida-hooks RubyGem version 1.0.1 contains malicious code that executes automatically during installation. This code collects sensitive system information including user identity, directory paths, hostname, and contents of critical system files, then exfiltrates this data over an encrypted connection to a hardcoded external server. This behavior is unrelated to the gem's stated purpose and occurs without user consent.
The dopc-client RubyGem versions 1.0.0 and 10.0.0 include malicious code that performs an unconsented plaintext HTTP GET request to a hardcoded IP address. This request sends sensitive environment information such as the installer's OS username, hostname, and current working directory to a third-party endpoint controlled by the author. The behavior occurs as a side effect of requiring the gem and is not configurable or opt-in by the user.
The RubyGems package 'intercom-react-native-example-e2e-tests' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No further technical details or exploit information are provided.
The RubyGems package 'shoaib-unity' version 1.0.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. No CVSS score or detailed technical exploit information is provided.
The RubyGems package 'macs-shoaibs-pro17' version 90002.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is considered malicious due to its communication with a domain linked to malicious activity. No CVSS score or detailed technical impact information is provided.
A vulnerability in the Shopify App's token-exchange authentication allowed cross-shop authorization bypass due to confusion between the authenticated shop context and the shop specified in the request parameter. This could lead to unauthorized access or actions in another shop's context if the application used the vulnerable helpers for security-sensitive decisions. The issue is fixed in shopify_app version 23.0.3.
Crass versions prior to 1.0.7 have a vulnerability where parsing input containing non-ASCII characters leads to superlinear CPU consumption due to inefficient tracking of multi-byte character positions. This can be exploited by an attacker to cause excessive CPU usage and potential denial of service. The issue is fixed in version 1.0.7.
Crass versions prior to 1.0.7 contain a vulnerability where processing a stylesheet with a large number of adjacent CSS comments causes excessive recursion, leading to a SystemStackError. This occurs when the default behavior of discarding comments is used (i.e., :preserve_comments option is false). The issue is fixed in version 1.0.7, which eliminates recursion when discarding comments. As a workaround, enabling the :preserve_comments option prevents the recursion and the error.
Crass versions prior to 1.0.7 contain a vulnerability where deeply nested CSS blocks and functions can cause unbounded recursion, leading to a SystemStackError or excessive memory consumption. This issue arises because Crass lacks a depth guard when parsing CSS simple blocks and functions. The vulnerability is fixed in version 1.0.7 by introducing a configurable depth limit with a conservative default.
Crass, a CSS tokenizer, incorrectly handles bad URL tokens when a closing parenthesis follows an escaped backslash, causing it to consume more input than browsers do. This flaw can cause CSS sanitizers that rely on Crass to mistakenly allow malicious CSS declarations, style rules, or at-rules such as @import to pass through. The vulnerability affects CSS sanitizers like Sanitize, Loofah, and rails-html-sanitizer, enabling attackers to smuggle CSS that can be used for UI redress, loading attacker-controlled resources, or CSS-based data exfiltration. The issue does not enable script execution in modern browsers. The vulnerability is fixed in Crass version 1.0.8.
Crass versions prior to 1.0.7 contain a vulnerability where processing CSS scientific notation numbers with very large exponents can cause excessive CPU and memory consumption, potentially leading to denial of service or application crashes. This occurs because Crass converts these numbers with unbounded exponentiation before clamping to Float::MAX. The issue is fixed in version 1.0.7.
The eth-gas-oracle RubyGem version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a hidden Ruby payload that establishes a reverse shell to a hardcoded IP address, allowing remote command execution on the installer's machine. The payload includes evasion techniques to avoid detection in sandbox or CI environments and requires the presence of developer artifacts to activate. The package metadata is inconsistent, indicating it is a disposable vehicle for malicious activity rather than legitimate functionality.
The multichain-rpc RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. This code executes during gem installation, launching a background process that connects to a remote host and provides an interactive shell to an attacker. The payload uses evasion techniques to avoid detection in developer and CI environments and delays execution by 20-40 minutes. The gem's visible code is a decoy, with stub methods and misleading documentation.
The web3-signer-kit RubyGem version 0.9.1 contains malicious code embedded in its extconf.rb file. During gem installation, it decodes and executes a base64 payload that establishes a remote shell connection to a hardcoded IP address, enabling full remote code execution. The payload includes sandbox evasion techniques and requires the presence of developer artifacts before activating. The gem itself has no legitimate functionality and acts as a decoy to deliver this malicious payload.