Critical RubyGems package vulnerabilities
The Beam CVE database tracks 31 critical package advisories for RubyGems: 31 critical severity. The newest is CVE-2026-77602, published Sep 23, 2026 and fixed in 7.3.0.
Critical-severity advisories for RubyGems packages from the GitHub Advisory Database, published since 2024. AI coding agents install packages on their own, so a vulnerable or malicious dependency can reach a project without a human picking it. Advisories for AI tools themselves are listed under each tool.
- Vulnerabilities tracked
- 31
- Critical
- 31
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-77602 · RubyGems
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
critical9.9Sep 23, 2026CVE-2026-55107 · RubyGems
kobako Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
critical10.0Aug 18, 2026CVE-2026-66066 · RubyGems
Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing
critical9.5Jul 30, 2026CVE-2026-44024 · RubyGems
Fluentd is Vulnerable to Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder
critical9.8Jun 26, 2026CVE-2026-55518 · RubyGems
Avo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation
critical9.6Jun 17, 2026CVE-2026-42087 · RubyGems
OpenC3 COSMOS has SQL Injection in QuestDB Time-Series Database
critical9.6Apr 23, 2026GHSA-2wvh-87g2-89hr · RubyGems
OpenC3 COSMOS: Permissions Bypass Provides User Access to Unassigned Administrative Actions via Script Runner Tool
critical9.6Apr 23, 2026CVE-2026-23891 · RubyGems
Decidim has a cross-site scripting (XSS) in user name
critical8.7Apr 13, 2026CVE-2026-39324 · RubyGems
Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization
critical9.1Apr 8, 2026CVE-2026-33286 · RubyGems
Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names
critical9.1Mar 20, 2026CVE-2025-68271 · RubyGems
openc3-api Vulnerable to Unauthenticated Remote Code Execution
critical10.0Jan 13, 2026CVE-2025-66567 · RubyGems
Ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)
critical9.3Dec 8, 2025CVE-2025-66568 · RubyGems
Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature validation
critical9.3Dec 8, 2025CVE-2011-10026 · RubyGems
Spree Commerce is vulnerable to RCE through Search API
critical9.3No fixAug 20, 2025CVE-2025-24293 · RubyGems
Active Storage allowed transformation methods that were potentially unsafe
critical9.2Aug 14, 2025CVE-2011-10019 · RubyGems
Spree has Remote Command Execution vulnerability in search functionality
critical9.8Aug 13, 2025CVE-2025-54887 · RubyGems
JWE is missing AES-GCM authentication tag validation in encrypted JWE
critical9.1Aug 7, 2025GHSA-353f-x4gh-cqq8 · RubyGems
Nokogiri patches vendored libxml2 to resolve multiple CVEs
criticalJul 21, 2025CVE-2025-53623 · RubyGems
Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class
critical9.3Jul 14, 2025CVE-2025-28384 · RubyGems
OpenC3 COSMOS Vulnerable to Directory Traversal via /script-api/scripts/ endpoint
critical9.1No fixJun 13, 2025CVE-2025-2304 · RubyGems
Camaleon CMS Vulnerable to Privilege Escalation through a Mass Assignment
critical9.4Mar 14, 2025CVE-2025-25291 · RubyGems
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
critical9.8Mar 12, 2025CVE-2025-25292 · RubyGems
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
critical9.8Mar 12, 2025CVE-2025-27407 · RubyGems
graphql allows remote code execution when loading a crafted GraphQL schema
critical9.0Mar 12, 2025GHSA-hw46-3hmr-x9xv · RubyGems
omniauth-saml has dependency on ruby-saml version with Signature Wrapping Attack issue
criticalMar 12, 2025CVE-2025-27590 · RubyGems
Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account
critical9.0Mar 3, 2025GHSA-cvp8-5r8g-fhvq · RubyGems
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
critical10.0Sep 11, 2024CVE-2024-45409 · RubyGems
SAML authentication bypass via Incorrect XPath selector
critical10.0Sep 10, 2024CVE-2024-42360 · RubyGems
Command Injection in sequenceserver
critical9.8Aug 13, 2024CVE-2024-27280 · RubyGems
StringIO buffer overread vulnerability
critical9.8Mar 25, 2024CVE-2023-28102 · RubyGems
discordrb OS Command Injection vulnerability
critical9.6Mar 14, 2024