https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:42:50 +0000 https://vulnerability.circl.lu/vuln/cve-2023-28120 <p><strong>Affected:</strong> Rails ActiveSupport</p> <p>There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.</p> <p><strong>Affected:</strong> Rails ActiveSupport</p> <p>There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.</p> https://vulnerability.circl.lu/vuln/cve-2023-28120 https://vulnerability.circl.lu/vuln/ghsa-pj73-v5mw-pm9j <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.</p> <p>Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3</p> <p># Impact</p> <p>ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.</p> <p>Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.</p> <p>All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.</p> <p># Workarounds</p> <p>Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.</p> <p><strong>Affected:</strong> RubyGems: activesupport</p> <p>There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.</p> <p>Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3</p> <p># Impact</p> <p>ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.</p> <p>Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.</p> <p>All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.</p> <p># Workarounds</p> <p>Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.</p> https://vulnerability.circl.lu/vuln/ghsa-pj73-v5mw-pm9j