Bilerden

**Name of the Vulnerable Software and Affected Versions** protobufjs versions prior to 7.6.5 protobufjs versions prior to 8.6.6 **Description** protobufjs compiles protobuf definitions into JavaScript functions. The software parses option names by advancing through schema tokens until an = token is reached without verifying the end of the input. Consequently, a specially crafted .proto schema that opens an option declaration and ends prematurely can cause the `parse()`, `Root.load()`, or `Root.loadSync()` functions to loop indefinitely. **Recommendations** Update protobufjs to version 7.6.5 or later. Update protobufjs to version 8.6.6 or later.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.19.4 **Description** In the JRuby implementation, the `NONET` parse option—enabled by default for `Nokogiri::XML::Schema`—was not correctly enforced. This allows a schema parsed with default options to fetch external resources over the network, which could lead to Server-Side Request Forgery (SSRF) or XML External Entity (XXE) attacks. SSRF is a technique where an attacker induces a server to make requests to an unintended location, and XXE is an attack that interferes with an application's processing of XML input. **Recommendations** Update to version 1.19.4.

**Name of the Vulnerable Software and Affected Versions** CarrierWave versions prior to 2.2.7 CarrierWave versions prior to 3.1.3 **Description** CarrierWave is a framework used to upload files from Ruby applications. The `content type denylist` check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the `denylisted content type()` function, denylist entries are interpolated directly into a regular expression without using `Regexp.quote` or anchoring. For example, an entry like `image/svg+xml` is treated as a pattern where the `+` character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as `application/xhtml+xml`, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin. **Recommendations** Update to version 2.2.7 for users on the 2.x branch. Update to version 3.1.3 for users on the 3.x branch. As a temporary workaround, restrict the use of the `content type denylist` feature until the software is updated.