From 5ba1d2f2c1574fc1fa2367679a79e7097f9136e9 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Thu, 22 Oct 2026 11:30:38 -0400 Subject: [PATCH 1/5] Two new advisories --- gems/crass/GHSA-pq4g-8rxf-4g29.yml | 37 +++++++++++++++ gems/view_component/GHSA-8qw7-6phv-7q6p.yml | 50 +++++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 gems/crass/GHSA-pq4g-8rxf-4g29.yml create mode 100644 gems/view_component/GHSA-8qw7-6phv-7q6p.yml diff --git a/gems/crass/GHSA-pq4g-8rxf-4g29.yml b/gems/crass/GHSA-pq4g-8rxf-4g29.yml new file mode 100644 index 0000000000..89d679424e --- /dev/null +++ b/gems/crass/GHSA-pq4g-8rxf-4g29.yml @@ -0,0 +1,37 @@ +--- +gem: crass +ghsa: pq4g-8rxf-4g29 +url: https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 +title: Incorrect tokenization of bad URLs enables CSS sanitizer bypass +date: 2026-10-21 +description: | + ## Summary + + Crass's tokenizer didn't terminate a bad URL token at a ) that followed + an escaped backslash (\\). As a result, Crass consumed more input as + part of the bad URL than a spec-compliant browser does. CSS sanitizers + that parse untrusted CSS with Crass and re-emit it could be tricked + into passing through declarations, style rules, or at-rules (including + @import) that the sanitizer would otherwise have removed, but that + a browser would then parse and apply. + + ## Impact + + Crass by itself only mis-tokenizes input. The security impact is on + CSS sanitizers that use Crass to make allow/deny decisions and then + re-serialize the CSS. Exploitation requires a sanitizer that doesn't + reject bad URL tokens wherever they occur. +cvss_v4: 5.3 +patched_versions: + - ">= 1.0.8" +related: + url: + - https://rubygems.org/gems/crass/versions/1.0.8 + - https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md#108-2026-10-21 + - https://github.com/rgrove/crass/compare/v1.0.7...v1.0.8 + - https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url + - https://osv.dev/vulnerability/GHSA-6wmf-3r64-vcwv + - https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 +notes: | + - No CVE in GHSA URL. + - cvss_v4 from GHSA URL. diff --git a/gems/view_component/GHSA-8qw7-6phv-7q6p.yml b/gems/view_component/GHSA-8qw7-6phv-7q6p.yml new file mode 100644 index 0000000000..059fc2c1c5 --- /dev/null +++ b/gems/view_component/GHSA-8qw7-6phv-7q6p.yml @@ -0,0 +1,50 @@ +--- +gem: view_component +ghsa: 8qw7-6phv-7q6p +url: https://github.com/ViewComponent/view_component/security/advisories/GHSA-8qw7-6phv-7q6p +title: ViewComponent - Incomplete fix for CVE-2026-54497 — slot and + with_content state still leak across reused component instances +date: 2026-08-26 +description: | + ## Summary + + CVE-2026-54497 was fixed by having render_in call __vc_reset_render_state!, + which clears exactly three ivars (@__vc_controller, @__vc_helpers, + @__vc_request) on every render so a reused ViewComponent::Base instance + can't leak the previous request's controller/helpers/request. The + fix's own comment admits it deliberately leaves two other pieces of + render-scoped state untouched: @__vc_set_slots (populated by with_ + setters) and @__vc_content_set_by_with_content (populated by with_content), + reasoning that these are "populated by callers before render_in runs." + That reasoning only holds for the intended one-instance-per-render + usage pattern — it breaks down in exactly the reuse/aliasing scenario + the CVE fix was written for, because these two ivars hold the actual + content/data being rendered (often user- or session-specific), not + just framework plumbing. + + ## IMPACT + + Any application that follows the common ViewComponent idiom of + pre-populating a component with request/user data via + with_content/with_ and then ends up reusing that same instance + across two different requests/users — due to caching, pooling, + memoization, or the aliasing pattern the vendor's own fix commit + explicitly anticipated — leaks the first user's data to the second, + despite the CVE-2026-54497 fix having run. + + ## CREDIT + + Yazan Balawneh, Cystack.ps +cvss_v3: 6.8 +patched_versions: + - ">= 4.14.0" +related: + url: + - https://github.com/ViewComponent/view_component/blob/main/docs/CHANGELOG.md#4140 + - https://github.com/ViewComponent/view_component/compare/v4.13.0...v4.14.0 + - https://github.com/ViewComponent/view_component/pull/2691 + - https://github.com/ViewComponent/view_component/security/advisories/GHSA-8qw7-6phv-7q6p +notes: | + - No CVE in GHSA URL. + - cvss_v3 from GHSA URL. + - Note that gem name in view_component and repo name is ViewComponent. From 913c3fead4de80774278fba6e4fdd79e07dd4920 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 23 Oct 2026 10:01:25 -0400 Subject: [PATCH 2/5] Update GHSA-pq4g-8rxf-4g29.yml to remove old link Removed outdated vulnerability link from the YAML file. --- gems/crass/GHSA-pq4g-8rxf-4g29.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/gems/crass/GHSA-pq4g-8rxf-4g29.yml b/gems/crass/GHSA-pq4g-8rxf-4g29.yml index 89d679424e..1d965c3906 100644 --- a/gems/crass/GHSA-pq4g-8rxf-4g29.yml +++ b/gems/crass/GHSA-pq4g-8rxf-4g29.yml @@ -30,7 +30,6 @@ related: - https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md#108-2026-10-21 - https://github.com/rgrove/crass/compare/v1.0.7...v1.0.8 - https://drafts.csswg.org/css-syntax-3/#consume-remnants-of-bad-url - - https://osv.dev/vulnerability/GHSA-6wmf-3r64-vcwv - https://github.com/rgrove/crass/security/advisories/GHSA-pq4g-8rxf-4g29 notes: | - No CVE in GHSA URL. From b8ce786e380eb12fbe39705786daf311532baf69 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 23 Oct 2026 10:02:25 -0400 Subject: [PATCH 3/5] Update gems/view_component/GHSA-8qw7-6phv-7q6p.yml Co-authored-by: Mike Dalessio --- gems/view_component/GHSA-8qw7-6phv-7q6p.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gems/view_component/GHSA-8qw7-6phv-7q6p.yml b/gems/view_component/GHSA-8qw7-6phv-7q6p.yml index 059fc2c1c5..5375bb2edf 100644 --- a/gems/view_component/GHSA-8qw7-6phv-7q6p.yml +++ b/gems/view_component/GHSA-8qw7-6phv-7q6p.yml @@ -4,7 +4,7 @@ ghsa: 8qw7-6phv-7q6p url: https://github.com/ViewComponent/view_component/security/advisories/GHSA-8qw7-6phv-7q6p title: ViewComponent - Incomplete fix for CVE-2026-54497 — slot and with_content state still leak across reused component instances -date: 2026-08-26 +date: 2026-08-28 description: | ## Summary From 3ea6a6827db16f9e9a423fc158cb2e7770ee5864 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 23 Oct 2026 10:03:12 -0400 Subject: [PATCH 4/5] Apply suggestion from @flavorjones Co-authored-by: Mike Dalessio --- gems/crass/GHSA-pq4g-8rxf-4g29.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gems/crass/GHSA-pq4g-8rxf-4g29.yml b/gems/crass/GHSA-pq4g-8rxf-4g29.yml index 1d965c3906..a34e68f097 100644 --- a/gems/crass/GHSA-pq4g-8rxf-4g29.yml +++ b/gems/crass/GHSA-pq4g-8rxf-4g29.yml @@ -20,7 +20,13 @@ description: | Crass by itself only mis-tokenizes input. The security impact is on CSS sanitizers that use Crass to make allow/deny decisions and then re-serialize the CSS. Exploitation requires a sanitizer that doesn't - reject bad URL tokens wherever they occur. + reject bad URL tokens wherever they occur. Confirmed examples: + + - Sanitize (all versions through 7.0.0): Sanitize::CSS.properties, + style attributes, Sanitize::CSS.stylesheet, and