Three new (activity_notification, graphql, spree_api) gem advisories

gems/activity_notification/GHSA-h5xx-m7vj-5vg2.yml

@@ -0,0 +1,25 @@
+---
+gem: activity_notification
+ghsa: h5xx-m7vj-5vg2
+url: https://github.com/simukappu/activity_notification/security/advisories/GHSA-h5xx-m7vj-5vg2
+title: SQL Injection via custom_filter in Bulk Notification Endpoints
+date: 2026-07-11
+description: |
+  ## Summary
+
+  The notifications_api_controller.rb bulk endpoints (open_all and
+  destroy_all) pass unfiltered request parameters to filtered_by_options,
+  which passes a custom_filter value directly to ActiveRecord's where()
+  as a raw SQL string. An unauthenticated attacker can inject arbitrary
+  SQL conditions, enabling mass data modification, mass data deletion,
+  and information disclosure via boolean-based exfiltration.
+patched_versions:
+  - ">= 2.7.0"
+related:
+  url:
+    - https://rubygems.org/gems/activity_notification/versions/2.7.0
+    - https://github.com/simukappu/activity_notification/compare/v2.6.1...v2.7.0
+    - https://github.com/simukappu/activity_notification/security/advisories/GHSA-h5xx-m7vj-5vg2
+notes: |
+  - Project GHSA has "Critical" severity, but no CVE or cvss values.
+  - date value from rubygems.org URL

gems/graphql/GHSA-j7xr-4g94-r9h3.yml

@@ -0,0 +1,43 @@
+---
+gem: graphql
+ghsa: j7xr-4g94-r9h3
+url: https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-j7xr-4g94-r9h3
+title: 'Authorization Bypass in Execution::Next'
+date: 2026-07-21
+description: |
+  ## Impact
+
+  In GraphQL-Ruby < v2.6.6, when using Execution::Next, authorization
+  failures did not properly halt execution for fields using
+  GraphQL::Schema::Resolver (and its subclasses, including
+  GraphQL::Schema::Mutation, GraphQL::Schema::RelayClassicMutation,
+  and GraphQL::Schema::Subscription) when they raised
+  GraphQL::UnauthorizedErrors.
+  Other forms of authorization were applied correctly.
+
+  If your application uses Execution::Next, update
+  GraphQL-Ruby to v2.6.6 or later.
+
+  ## Credit
+
+  This issue was discovered with the GitHub Security Lab Taskflow Agent
+  as part of Project Glasswing, a cross-industry initiative to secure
+  critical open-source software using frontier AI models, and manually
+  verified by GHSL team member: @anticomputer.
+unaffected_versions:
+  - "< 2.5.23"
+patched_versions:
+  - ">= 2.6.6"
+related:
+  url:
+    - https://rubygems.org/gems/graphql/versions/2.6.6
+    - https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md#266-21-jul-2026
+    - https://github.com/rmosolgo/graphql-ruby/compare/v2.6.5...v2.6.6
+    - https://github.com/GitHubSecurityLab/seclab-taskflow-agent
+    - https://www.anthropic.com/glasswing
+    - https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-j7xr-4g94-r9h3
+notes: |
+  - Note that gem name is "grahhql" but repo name is "graphql-ruby".
+  - Project GHSA has "High" severity.
+  - No CVE in project GHSA so no cvss values.
+  - date value from rubygems.org URL.

gems/spree_api/GHSA-4825-p4xm-pcf2.yml

@@ -0,0 +1,65 @@
+---
+gem: spree_api
+ghsa: 4825-p4xm-pcf2
+url: https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
+title: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)
+date: 2026-07-20
+description: |
+  ## Summary
+
+  The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds
+  a guest cart to the authenticated caller without verifying possession
+  of that cart. It locates the cart by prefixed ID only —
+  current_store.carts.where(user: [nil, current_user]).find_by_prefix_id!(
+  params[:id]) — and omits the authorize!(:update, @cart, cart_token)
+  check that every other action in the controller performs via CartResolvable.
+  Because prefixed IDs are a reversible Sqids encoding of the auto-increment
+  primary key (obfuscation, not a token), an authenticated customer can
+  name arbitrary guest cart IDs, take them over, and read the checkout
+  addresses stored on them. This is broken access control / IDOR,
+  reachable by any low-privilege registered user.
+
+  ## Severity
+
+  Requires an authenticated store account and depends on target guest
+  carts already carrying an address and not yet being associated, on a
+  store not running in login_required mode. Confidentiality impact is
+  the driver (guest checkout PII); integrity impact is limited and
+  recoverable (cart reassignment + email overwrite on an in-progress
+  cart). Not Critical: the action is gated behind authentication (PR:L, not
+  PR:N) and constrained by cart state, so it is not anonymously exploitable.
+
+  ## Impact
+
+  Confidentiality: an authenticated attacker can enumerate guest cart
+  IDs and read checkout PII (name, street, postal code, phone) on carts
+  they don't own. Integrity: limited and recoverable — each call reassigns
+  the guest cart and overwrites its email, disrupting the original
+  guest's in-progress cart. Requires a registered account, so not
+  anonymously exploitable.
+
+  ## Remediation
+
+  Update to Spree 5.4.4 or 5.5.4.
+
+  Your storefront, based on https://github.com/spree/storefront,
+  doesn't need any updates because it has always sent a cart
+  token when associating carts; this is a backend issue.
+cvss_v3: 7.1
+unaffected_versions:
+  - "< 5.4.0"
+patched_versions:
+  - "~> 5.4.4"
+  - ">= 5.5.4"
+related:
+  url:
+    - https://rubygems.org/gems/spree_api/versions/5.5.4
+      - https://github.com/spree/spree/releases/tag/v5.5.4
+    - https://rubygems.org/gems/spree_api/versions/5.4.4
+      - https://github.com/spree/spree/releases/tag/v5.4.4
+    - https://github.com/spree/spree/security/advisories/GHSA-4825-p4xm-pcf2
+notes: |
+  - NOTE: Gem name is "spree_api" but repo name is "spree".
+  - cvss_v3 from project GHSA
+  - No CVE in project GHSA
+  - date field is rubygems.org release date.