Skip to content

Commit a2da6b7

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-4249-gjr8-jpq3 GHSA-pm3x-jrhh-qcr7
1 parent 69b1acd commit a2da6b7

File tree

2 files changed

+136
-0
lines changed

2 files changed

+136
-0
lines changed

‎advisories/github-reviewed/2025/11/GHSA-4249-gjr8-jpq3/GHSA-4249-gjr8-jpq3.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4249-gjr8-jpq3",
4+
"modified": "2025-11-13T22:59:15Z",
5+
"published": "2025-11-13T22:59:15Z",
6+
"aliases": [],
7+
"summary": "ProsemirrorToHtml has a Cross-Site Scripting (XSS) vulnerability through unescaped HTML attribute values",
8+
"details": "### Impact\n\nThe prosemirror_to_html gem is vulnerable to Cross-Site Scripting (XSS) attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values are not, allowing attackers to inject arbitrary JavaScript code.\n\n**Who is impacted:**\n\n- Any application using prosemirror_to_html to convert ProseMirror documents to HTML\n- Applications that process user-generated ProseMirror content are at highest risk\n- End users viewing the rendered HTML output could have malicious JavaScript executed in their browsers\n\n**Attack vectors include:**\n\n- `href` attributes with `javascript:` protocol:\n `<a href=\"javascript:alert(document.cookie)\">`\n- Event handlers: `<div onclick=\"maliciousCode()\">`\n- `onerror` attributes on images: `<img src=x onerror=\"alert('XSS')\">`\n- Other HTML attributes that can execute JavaScript\n\n### Patches\n\nA fix is currently in development. Users should upgrade to version **0.2.1** or later once released. The patch escapes all HTML attribute values using `CGI.escapeHTML` to prevent injection attacks.\n\n### Workarounds\n\nUntil a patched version is available, users can implement one or more of these mitigations:\n\n1. **Sanitize output**: Pass the HTML output through a sanitization\n library like [Sanitize](https://github.com/rgrove/sanitize) or\n [Loofah](https://github.com/flavorjones/loofah):\n\n```ruby\n html = ProsemirrorToHtml.render(document)\n safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)\n```\n\n2. **Implement Content Security Policy (CSP)**: Add strict CSP\n headers to prevent inline JavaScript execution:\n```\n Content-Security-Policy: default-src 'self'; script-src 'self'\n```\n\n3. **Input validation**: If possible, validate and sanitize\n ProseMirror documents before conversion to prevent malicious\n content from entering the system.\n\n### References\n\n- Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249\n- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)",
9+
"severity": [
10+
{
11+
"type": "CVSS_V4",
12+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
13+
}
14+
],
15+
"affected": [
16+
{
17+
"package": {
18+
"ecosystem": "RubyGems",
19+
"name": "prosemirror_to_html"
20+
},
21+
"ranges": [
22+
{
23+
"type": "ECOSYSTEM",
24+
"events": [
25+
{
26+
"introduced": "0"
27+
},
28+
{
29+
"fixed": "0.2.1"
30+
}
31+
]
32+
}
33+
]
34+
}
35+
],
36+
"references": [
37+
{
38+
"type": "WEB",
39+
"url": "https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx"
40+
},
41+
{
42+
"type": "WEB",
43+
"url": "https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8"
44+
},
45+
{
46+
"type": "WEB",
47+
"url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html"
48+
},
49+
{
50+
"type": "PACKAGE",
51+
"url": "https://github.com/etaminstudio/prosemirror_to_html"
52+
},
53+
{
54+
"type": "WEB",
55+
"url": "https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249"
56+
},
57+
{
58+
"type": "WEB",
59+
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/prosemirror_to_html/GHSA-vfpf-xmwh-8m65.yml"
60+
}
61+
],
62+
"database_specific": {
63+
"cwe_ids": [
64+
"CWE-79"
65+
],
66+
"severity": "HIGH",
67+
"github_reviewed": true,
68+
"github_reviewed_at": "2025-11-13T22:59:15Z",
69+
"nvd_published_at": null
70+
}
71+
}

‎advisories/github-reviewed/2025/11/GHSA-pm3x-jrhh-qcr7/GHSA-pm3x-jrhh-qcr7.json‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-pm3x-jrhh-qcr7",
4+
"modified": "2025-11-13T22:58:20Z",
5+
"published": "2025-11-13T22:58:20Z",
6+
"aliases": [
7+
"CVE-2025-64529"
8+
],
9+
"summary": "SpiceDB WriteRelationships fails silently if payload is too big",
10+
"details": "### Impact\n\nUsers who:\n1. Use the exclusion operator somewhere in their authorization schema.\n1. Have configured their SpiceDB server such that `--write-relationships-max-updates-per-call` is bigger than 6500.\n1. Issue calls to WriteRelationships with a large enough number of updates that cause the payload to be bigger than what their datastore allows.\n\nUsers will:\n\n1. Receive a successful response from their `WriteRelationships` call, when in reality that call failed.\n2. Receive incorrect permission check results, if those relationships had to be read to resolve the relation involving the exclusion.\n\n### Patches\n\nUpgrade to v.145.2.\n\n### Workarounds\n\nSet `--write-relationships-max-updates-per-call` to `1000`.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/authzed/spicedb"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.45.2"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/authzed/spicedb/security/advisories/GHSA-pm3x-jrhh-qcr7"
42+
},
43+
{
44+
"type": "ADVISORY",
45+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64529"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/authzed/spicedb/commit/d0cd103a92cc1915636733fb1d1730c2c7f74851"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/authzed/spicedb"
54+
}
55+
],
56+
"database_specific": {
57+
"cwe_ids": [
58+
"CWE-770"
59+
],
60+
"severity": "LOW",
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2025-11-13T22:58:20Z",
63+
"nvd_published_at": "2025-11-10T23:15:42Z"
64+
}
65+
}

0 commit comments

Comments
 (0)