Updated advisory posts against rubysec/ruby-advisory-db@abb2367

Author: jasnow

advisories/_posts/2026-07-22-GHSA-7m8w-vg9p-qjr6.md

@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'GHSA-7m8w-vg9p-qjr6 (alchemy_cms): Stored XSS in SelectView via Missing Server-Side
+  Option Validation'
+comments: false
+categories:
+- alchemy_cms
+advisory:
+  gem: alchemy_cms
+  ghsa: 7m8w-vg9p-qjr6
+  url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-7m8w-vg9p-qjr6
+  title: Stored XSS in SelectView via Missing Server-Side Option Validation
+  date: 2026-07-22
+  description: |-
+    ## Summary
+
+    Alchemy::Ingredients::SelectView#call delegates to super (i.e.,
+    Alchemy::Ingredients::BaseView#call) for the single-value path, which
+    returns value.html_safe. The allowed option list (select_values)
+    defined in elements.yml is enforced only in the admin UI dropdown;
+    no server-side validation checks that a submitted value belongs to
+    the allowed set. An authenticated CMS author can bypass the dropdown
+    by sending a direct API request with an arbitrary HTML string as the
+    ingredient value. That string is stored verbatim and rendered unescaped
+    into the published public page, executing in every visitor's browser.
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 8.0.16"
+  - "~> 8.1.15"
+  - "~> 8.2.9"
+  - ">= 8.3.5"
+  related:
+    url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.5 - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.5
+      - https://github.com/AlchemyCMS/alchemy_cms/pull/4081
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.9
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.15
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.16
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-7m8w-vg9p-qjr6
+  notes: |
+    - No CVE value in project GHSA
+    - cvss_v3 from project GHSA
+    - Changelog only goes to 8.3.0.
+    - date from rubygems.or 8.3.5 release date
+---

advisories/_posts/2026-07-22-GHSA-pm72-wq9v-wvfh.md

@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'GHSA-pm72-wq9v-wvfh (alchemy_cms): Stored XSS in PictureView figcaption via
+  html_safe on User Caption'
+comments: false
+categories:
+- alchemy_cms
+advisory:
+  gem: alchemy_cms
+  ghsa: pm72-wq9v-wvfh
+  url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh
+  title: Stored XSS in PictureView figcaption via html_safe on User Caption
+  date: 2026-07-22
+  description: |-
+    ## Summary
+
+    Alchemy::Ingredients::PictureView#caption calls ingredient.caption.html_safe
+    and passes the result to content_tag(:figcaption, ...). The caption
+    value is user-supplied (set via the ingredients_attributes[caption]
+    parameter in the element save API) and is stored in a JSON data column
+    with no sanitization. Because .html_safe is called before content_tag,
+    Rails' automatic HTML escaping is suppressed and the raw user string
+    is emitted into the published page, executing in every visitor's browser.
+  cvss_v3: 5.4
+  patched_versions:
+  - "~> 8.0.16"
+  - "~> 8.1.15"
+  - "~> 8.2.9"
+  - ">= 8.3.5"
+  related:
+    url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.5 - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.5
+      - https://github.com/AlchemyCMS/alchemy_cms/pull/4081
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.9
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.15
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.16
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh
+  notes: |
+    - No CVE in project GHSA
+    - cvss_v3 from project GHSA
+    - Changelog only goes to 8.3.0.
+    - date from rubygems.or 8.3.5 release date
+---

advisories/_posts/2026-07-28-GHSA-r827-6rm4-59pg.md

@@ -0,0 +1,45 @@
+---
+layout: advisory
+title: 'GHSA-r827-6rm4-59pg (alchemy_cms): Stored XSS via unsanitized SVG attachment
+  replacement'
+comments: false
+categories:
+- alchemy_cms
+advisory:
+  gem: alchemy_cms
+  ghsa: r827-6rm4-59pg
+  url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-r827-6rm4-59pg
+  title: Stored XSS via unsanitized SVG attachment replacement
+  date: 2026-07-28
+  description: |-
+    ## Summary
+
+    AlchemyCMS registers its SVG sanitizer (SanitizeSvgJob, a Loofah-based
+    scrubber) only as an after_create_commit callback on Alchemy::Attachment /
+    Alchemy::Picture. This callback fires when a new attachment record is
+    created, but not when an existing attachment's file is replaced through
+    the admin "update" action. An authenticated user holding the editor
+    role (i.e. manage Alchemy::Attachment permission, a low-privilege,
+    non-admin role) can PATCH an existing attachment to replace its file
+    with a malicious SVG containing <script> / onload= payloads. Because
+    the sanitizer never runs on this path, and because AlchemyCMS explicitly
+    configures SVG as an inline-servable content type on Active Storage,
+    the public, unauthenticated /attachment/:id/show route streams the
+    attacker's raw SVG payload with Content-Disposition: inline. Any
+    visitor (including other admins) who opens the attachment URL executes
+    attacker-controlled JavaScript in the AlchemyCMS application origin.
+
+    This is a stored, privilege-crossing Cross-Site Scripting vulnerability,
+    confirmed both by static code review and by live dynamic reproduction
+    against an unmodified AlchemyCMS instance.
+  cvss_v3: 8.7
+  patched_versions:
+  - ">= 8.3.6"
+  related:
+    url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.6
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-r827-6rm4-59pg
+  notes: |
+    - cvss_v3 from project GHSA
+    - No CVE in project GHSA
+---