From fc49da1896ca3379e8c761e8f44f26f75f02a703 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Fri, 11 Sep 2026 19:55:14 -0400 Subject: [PATCH 1/3] Two new advisories --- gems/mongo-ruby-driver/CVE-2026-88030.yml | 37 +++++++++++++++++++++++ rubies/mruby/CVE-2026-79590.yml | 31 +++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 gems/mongo-ruby-driver/CVE-2026-88030.yml create mode 100644 rubies/mruby/CVE-2026-79590.yml diff --git a/gems/mongo-ruby-driver/CVE-2026-88030.yml b/gems/mongo-ruby-driver/CVE-2026-88030.yml new file mode 100644 index 0000000000..63f8dd3dc7 --- /dev/null +++ b/gems/mongo-ruby-driver/CVE-2026-88030.yml @@ -0,0 +1,37 @@ +--- +gem: mongo-ruby-driver +cve: 2026-88030 +ghsa: 4ww7-gqv6-mffc +url: https://nvd.nist.gov/vuln/detail/CVE-2026-88030 +title: MongoDB Ruby Driver - Improper neutralization of special + elements in data query logic in the GridFS component +date: 2026-09-10 +description: | + Improper neutralization of special elements in data query logic in + the GridFS component of the MongoDB Ruby Driver can cause a + caller-supplied structured file identifier to be interpreted as a + query condition rather than as a literal identifier. An authenticated + user who can influence the identifier passed by an affected applicatio + may obtain stored file content beyond the intended target or cause + all GridFS file chunks in the affected bucket to be removed, + rendering stored file content unreadable. +cvss_v3: 8.3 +cvss_v4: 6.1 +patched_versions: + - ">= 2.26.0" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-88030 + - https://rubygems.org/gems/mongo/versions/2.26.0 + - https://github.com/mongodb/mongo-ruby-driver/releases/tag/v2.26.0 + - https://github.com/mongodb/mongo-ruby-driver/pull/3105 + - https://github.com/mongodb/mongo-ruby-driver/commit/ed62bb56c2e24c79113709331862d0aa3da74c6d + - https://jira.mongodb.org/browse/RUBY-3941 + - https://github.com/advisories/GHSA-4ww7-gqv6-mffc +notes: | + - cvss_v4 from GHSA and nvd.nist.gov URLs. + - cvss_v3 from nvd.nist.gov URLs. + - Found "Use exact match for file ID in GridFS methods (CVE-2026-88030)" + reference above in commit ang releases/tag URLs. + - NOTE: gem name is "mongo" and repo name is "mongo-ruby-driver". + - This is an unreviewed GHSA advisory. diff --git a/rubies/mruby/CVE-2026-79590.yml b/rubies/mruby/CVE-2026-79590.yml new file mode 100644 index 0000000000..8c134be01c --- /dev/null +++ b/rubies/mruby/CVE-2026-79590.yml @@ -0,0 +1,31 @@ +--- +engine: mruby +cve: 2026-79590 +ghsa: q9f2-rhj2-x3xg +url: https://nvd.nist.gov/vuln/detail/CVE-2026-79590 +title: A NULL pointer dereference vulnerability in mruby 4.0.0 +date: 2026-09-10 +description: | + A NULL pointer dereference vulnerability exists in the Prism parser + component of mruby 4.0.0. An attacker can provide a specially + crafted Ruby source file that triggers the parser to pass a + NULL pointer to nonnull string handling functions, resulting + in undefined behavior and application crash. +patched_versions: + - ">= 4.1.0-rc2" +related: + url: + - https://nvd.nist.gov/vuln/detail/CVE-2026-79590 + - https://github.com/mruby/mruby/blob/master/NEWS.md#user-visible-changes-in-mruby41-from-mruby40 + - https://github.com/mruby/mruby/compare/4.0.0...4.1.0-rc + - https://github.com/mruby/mruby/commit/c6866eed4ad5640b552ba79d16063e7ec70a0ac9 + - https://github.com/mruby/mruby/issues/7032 + - https://github.com/advisories/GHSA-q9f2-rhj2-x3xg +notes: | + - Neither GHSA or nvd.nist.gov URL have cvss values. + - It is an unreviewed GHSA advisory. + - Found https://github.com/mruby/mruby/issues/7032 reference + in this file under "Fixed GitHub Issues" + - https://github.com/mruby/mruby/blob/master/NEWS.md#user-visible-changes-in-mruby41-from-mruby40 + - https://github.com/mruby/mruby/commit/c6866eed4ad5640b552ba79d16063e7ec70a0ac9 + (mruby-compiler: give Prism an allocator that answers a zero size) From 10ae903c34313da363f5f8d160580be09c513c14 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 13 Sep 2026 14:28:28 -0400 Subject: [PATCH 2/3] Fixed PR requested changes --- gems/{mongo-ruby-driver => mongo}/CVE-2026-88030.yml | 6 +++--- rubies/mruby/CVE-2026-79590.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) rename gems/{mongo-ruby-driver => mongo}/CVE-2026-88030.yml (94%) diff --git a/gems/mongo-ruby-driver/CVE-2026-88030.yml b/gems/mongo/CVE-2026-88030.yml similarity index 94% rename from gems/mongo-ruby-driver/CVE-2026-88030.yml rename to gems/mongo/CVE-2026-88030.yml index 63f8dd3dc7..58c06247af 100644 --- a/gems/mongo-ruby-driver/CVE-2026-88030.yml +++ b/gems/mongo/CVE-2026-88030.yml @@ -1,5 +1,5 @@ --- -gem: mongo-ruby-driver +gem: mongo cve: 2026-88030 ghsa: 4ww7-gqv6-mffc url: https://nvd.nist.gov/vuln/detail/CVE-2026-88030 @@ -11,7 +11,7 @@ description: | the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated - user who can influence the identifier passed by an affected applicatio + user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. @@ -32,6 +32,6 @@ notes: | - cvss_v4 from GHSA and nvd.nist.gov URLs. - cvss_v3 from nvd.nist.gov URLs. - Found "Use exact match for file ID in GridFS methods (CVE-2026-88030)" - reference above in commit ang releases/tag URLs. + reference above in commit and releases/tag URLs. - NOTE: gem name is "mongo" and repo name is "mongo-ruby-driver". - This is an unreviewed GHSA advisory. diff --git a/rubies/mruby/CVE-2026-79590.yml b/rubies/mruby/CVE-2026-79590.yml index 8c134be01c..c84221e269 100644 --- a/rubies/mruby/CVE-2026-79590.yml +++ b/rubies/mruby/CVE-2026-79590.yml @@ -12,7 +12,7 @@ description: | NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash. patched_versions: - - ">= 4.1.0-rc2" + - ">= 4.1.0-rc" related: url: - https://nvd.nist.gov/vuln/detail/CVE-2026-79590 From de4247d7d158bfb71a1f94d2d36c7cb22f82c061 Mon Sep 17 00:00:00 2001 From: Al Snow <43523+jasnow@users.noreply.github.com> Date: Sun, 13 Sep 2026 18:04:15 -0400 Subject: [PATCH 3/3] Add unaffected_versions field/value for both advisories --- gems/mongo/CVE-2026-88030.yml | 2 ++ rubies/mruby/CVE-2026-79590.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/gems/mongo/CVE-2026-88030.yml b/gems/mongo/CVE-2026-88030.yml index 58c06247af..2134d83132 100644 --- a/gems/mongo/CVE-2026-88030.yml +++ b/gems/mongo/CVE-2026-88030.yml @@ -17,6 +17,8 @@ description: | rendering stored file content unreadable. cvss_v3: 8.3 cvss_v4: 6.1 +unaffected_versions: + - "< 2.0.0" patched_versions: - ">= 2.26.0" related: diff --git a/rubies/mruby/CVE-2026-79590.yml b/rubies/mruby/CVE-2026-79590.yml index c84221e269..823107677f 100644 --- a/rubies/mruby/CVE-2026-79590.yml +++ b/rubies/mruby/CVE-2026-79590.yml @@ -11,6 +11,8 @@ description: | crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash. +unaffected_versions: + - "< 4.0.0" patched_versions: - ">= 4.1.0-rc" related: