From 733584c30521894a3c3b5a0d1030a7577b998345 Mon Sep 17 00:00:00 2001 From: Connor Shea <2977353+connorshea@users.noreply.github.com> Date: Fri, 19 Jun 2026 12:23:26 -0600 Subject: [PATCH 1/3] Improve PoC/Proof of Concept detection to match more variations. This updates the RSpec check and the checks for the JSON Schemas to catch different capitalizations and also the full "Proof of Concept" phrase. And update YML files that violated the improved rule. Fixes #1131. --- README.md | 6 ++++-- gems/bsv-sdk/CVE-2026-40070.yml | 25 ------------------------- gems/bsv-wallet/CVE-2026-40070.yml | 25 ------------------------- gems/camaleon_cms/CVE-2024-46987.yml | 6 ------ gems/carrierwave/CVE-2021-21305.yml | 9 --------- gems/google-protobuf/CVE-2021-22569.yml | 5 ----- gems/google-protobuf/CVE-2024-7254.yml | 6 ------ gems/jquery-rails/CVE-2012-6708.yml | 5 ----- spec/advisory_example.rb | 2 +- spec/schemas/gem.json | 2 +- spec/schemas/ruby.json | 2 +- 11 files changed, 7 insertions(+), 86 deletions(-) diff --git a/README.md b/README.md index e5e66fbd94..d5c70932cb 100644 --- a/README.md +++ b/README.md @@ -144,7 +144,8 @@ patched_versions: vulnerability. It may contain multiple paragraphs. * Used `description: |` if it is more than one sentence/line. * Line wrap `descriptions:` field at 80. - * Do no include "POC" or "PoC" in `description:` field. + * Do not include "POC", "PoC", or "Proof of Concept" heading sections + (any casing) in the `description:` field. * Not use "\n" or "%" in `description:` field. * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability. * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability. @@ -183,7 +184,8 @@ patched_versions: * Used `description: |` (not `|-`) if it is more than one sentence/line. * Line wrap `descriptions:` field at 80. * Not use "\n" or "%" in `description:` field. - * Do no include "POC" or "PoC" in `description:` field. + * Do not include "POC", "PoC", or "Proof of Concept" heading sections + (any casing) in the `description:` field. * `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability. * `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability. * `cvss_v4` \[Float\] (optional): The [CVSSv4] score for the vulnerability. diff --git a/gems/bsv-sdk/CVE-2026-40070.yml b/gems/bsv-sdk/CVE-2026-40070.yml index eee3800744..0da16dfd13 100644 --- a/gems/bsv-sdk/CVE-2026-40070.yml +++ b/gems/bsv-sdk/CVE-2026-40070.yml @@ -120,31 +120,6 @@ description: | attacker-controlled data. - **A:N** — availability unaffected. - ## Proof of concept - - ```ruby - client = BSV::Wallet::WalletClient.new(key, - storage: BSV::Wallet::MemoryStore.new) - - client.acquire_certificate( - type: 'age-over-18', - acquisition_protocol: 'direct', - certifier: claimed_trusted_pubkey_hex, - serial_number: 'any-serial', - revocation_outpoint: ('00' * 32) + '.0', - signature: 'deadbeef' * 16, # arbitrary bytes — never verified - fields: { 'verified' => 'true' }, - keyring_for_subject: {} - ) - - client.list_certificates( - certifiers: [claimed_trusted_pubkey_hex], - types: ['age-over-18'] - ) - # => returns the forged record as if it were a real - # certificate from that certifier - ``` - ## Affected versions The vulnerable direct-path code was introduced in commit `d14dd19` diff --git a/gems/bsv-wallet/CVE-2026-40070.yml b/gems/bsv-wallet/CVE-2026-40070.yml index e494a46f6b..9661e187ad 100644 --- a/gems/bsv-wallet/CVE-2026-40070.yml +++ b/gems/bsv-wallet/CVE-2026-40070.yml @@ -123,31 +123,6 @@ description: | attacker-controlled data. - **A:N** — availability unaffected. - ## Proof of concept - - ```ruby - client = BSV::Wallet::WalletClient.new(key, - storage: BSV::Wallet::MemoryStore.new) - - client.acquire_certificate( - type: 'age-over-18', - acquisition_protocol: 'direct', - certifier: claimed_trusted_pubkey_hex, - serial_number: 'any-serial', - revocation_outpoint: ('00' * 32) + '.0', - signature: 'deadbeef' * 16, # arbitrary bytes — never verified - fields: { 'verified' => 'true' }, - keyring_for_subject: {} - ) - - client.list_certificates( - certifiers: [claimed_trusted_pubkey_hex], - types: ['age-over-18'] - ) - # => returns the forged record as if it were a real certificate - # from that certifier - ``` - ## Affected versions The vulnerable direct-path code was introduced in commit `d14dd19` diff --git a/gems/camaleon_cms/CVE-2024-46987.yml b/gems/camaleon_cms/CVE-2024-46987.yml index 94bfc5db0c..6645dc9c8b 100644 --- a/gems/camaleon_cms/CVE-2024-46987.yml +++ b/gems/camaleon_cms/CVE-2024-46987.yml @@ -43,12 +43,6 @@ description: | [send_file]: https://github.com/owen2345/camaleon-cms/blob/feccb96e542319ed608acd3a16fa5d92f13ede67/app/controllers/camaleon_cms/admin/media_controller.rb#L33-L34 - ## Proof of concept - - An authenticated user can download the /etc/passwd file by visiting an URL such as: - - https:///admin/media/download_private_file?file=../../../../../../etc/passwd - ## Impact This issue may lead to Information Disclosure. diff --git a/gems/carrierwave/CVE-2021-21305.yml b/gems/carrierwave/CVE-2021-21305.yml index 77ad3ea94c..086ce4a3e9 100644 --- a/gems/carrierwave/CVE-2021-21305.yml +++ b/gems/carrierwave/CVE-2021-21305.yml @@ -15,15 +15,6 @@ description: | (But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension) - ### Proof of Concept - ```ruby - class MyUploader < CarrierWave::Uploader::Base - include CarrierWave::RMagick - end - - MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked" - ``` - ### Patches Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2). diff --git a/gems/google-protobuf/CVE-2021-22569.yml b/gems/google-protobuf/CVE-2021-22569.yml index 006ed166c5..bc0002ce9c 100644 --- a/gems/google-protobuf/CVE-2021-22569.yml +++ b/gems/google-protobuf/CVE-2021-22569.yml @@ -23,11 +23,6 @@ description: | minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses. - ## Proof of Concept - - For reproduction details, please refer to the oss-fuzz issue that identifies - the specific inputs that exercise this parsing weakness. - ## Remediation and Mitigation Please update to the latest available versions of the following packages: diff --git a/gems/google-protobuf/CVE-2024-7254.yml b/gems/google-protobuf/CVE-2024-7254.yml index ce6a06a19c..789a0a8054 100644 --- a/gems/google-protobuf/CVE-2024-7254.yml +++ b/gems/google-protobuf/CVE-2024-7254.yml @@ -27,12 +27,6 @@ description: |+ or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker. - ### Proof of Concept - For reproduction details, please refer to the unit tests (Protobuf Java - [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) - and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) - that identify the specific inputs that exercise this parsing weakness. - ### Remediation and Mitigation We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest diff --git a/gems/jquery-rails/CVE-2012-6708.yml b/gems/jquery-rails/CVE-2012-6708.yml index 60457d01b2..12a9e67784 100644 --- a/gems/jquery-rails/CVE-2012-6708.yml +++ b/gems/jquery-rails/CVE-2012-6708.yml @@ -13,11 +13,6 @@ description: | the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution. - - ## Proof of Concept - $("#log").html( - $("element[attribute='']").html() - ); cvss_v2: 4.3 cvss_v3: 6.1 patched_versions: diff --git a/spec/advisory_example.rb b/spec/advisory_example.rb index eaedbf136d..b160580f74 100644 --- a/spec/advisory_example.rb +++ b/spec/advisory_example.rb @@ -153,7 +153,7 @@ end it "must not have PoC sections" do - expect(subject).to_not include("### PoC") + expect(subject).to_not match(/(#+) *(?:poc\b|proof of concept)/i) end it { expect(subject).to be_kind_of(String) } diff --git a/spec/schemas/gem.json b/spec/schemas/gem.json index 6924c1e7a9..db4965b357 100644 --- a/spec/schemas/gem.json +++ b/spec/schemas/gem.json @@ -58,7 +58,7 @@ "pattern": "^(?=.{1,80}$)(?=.*\\n)(?:[^\n]{1,80})(?:\n[^\n]{1,80})*$", "allOf": [ { "not": { "pattern": "\\\\n\\\\n" } }, - { "not": { "pattern": "(#+) PoC" } } + { "not": { "pattern": "(?i)(#+) *(poc\\b|proof of concept)" } } ] }, "cvss_v2": { diff --git a/spec/schemas/ruby.json b/spec/schemas/ruby.json index bc59095e60..24b26b5a89 100644 --- a/spec/schemas/ruby.json +++ b/spec/schemas/ruby.json @@ -54,7 +54,7 @@ "pattern": "^(?=.{1,80}$)(?=.*\\n)(?:[^\n]{1,80})(?:\n[^\n]{1,80})*$", "allOf": [ { "not": { "pattern": "\\\\n\\\\n" } }, - { "not": { "pattern": "(#+) PoC" } } + { "not": { "pattern": "(?i)(#+) *(poc\\b|proof of concept)" } } ] }, "cvss_v2": { From 2691027254fd7dc50669232c8604cfc854f47bc9 Mon Sep 17 00:00:00 2001 From: Connor Shea <2977353+connorshea@users.noreply.github.com> Date: Fri, 19 Jun 2026 17:56:33 -0600 Subject: [PATCH 2/3] Remove one more proof of concept section. --- gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml b/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml index 287f7a5a0e..0e010800e3 100644 --- a/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml +++ b/gems/camaleon_cms/GHSA-7x4w-cj9r-h4v9.yml @@ -40,22 +40,6 @@ description: | Where it is joined in an unchecked manner with the root folder and then deleted. - **Proof of concept** - The following request would delete the file README.md in the top - folder of the Ruby on Rails application. (The values for auth_token, - X-CSRF-Token and _cms_session would also need to be replaced with - authenticated values in the curl command below) - ``` - curl --path-as-is -i -s -k -X $'POST' \ - -H $'X-CSRF-Token: [..]' -H $'User-Agent: Mozilla/5.0' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Accept: */*' -H $'Connection: keep-alive' \ - -b $'auth_token=[..]; _cms_session=[..]' \ - --data-binary $'versions=&thumb_size=&formats=&media_formats=&dimension=&private=&folder=.. - 2F.. - 2F.. - 2FREADME.md&media_action=del_file' \ - $'https:///admin/media/actions?actions=true' - ``` - **Impact** This issue may lead to a defective CMS or system. From c13ebd2034e27497a7f98d80c2076f700580d913 Mon Sep 17 00:00:00 2001 From: Connor Shea <2977353+connorshea@users.noreply.github.com> Date: Fri, 19 Jun 2026 17:57:11 -0600 Subject: [PATCH 3/3] Remove mention of PoC link. --- gems/spree_api/CVE-2026-22588.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/gems/spree_api/CVE-2026-22588.yml b/gems/spree_api/CVE-2026-22588.yml index 36187b40fc..6881574d79 100644 --- a/gems/spree_api/CVE-2026-22588.yml +++ b/gems/spree_api/CVE-2026-22588.yml @@ -34,8 +34,6 @@ description: | authorized to modify their own order, the backend does not verify that the supplied address identifiers belong to the same authenticated user. - **See reference below for POC.** - ### Impact As a result, an attacker can: