[flavorjones]

Motivation

The Rails maintainers published these GitHub security advisories on 2026-11-04 for vulnerabilities fixed in Rails 8.0.5.2 and 8.1.4.1. None has been assigned a CVE yet, and none is in the GitHub Advisory Database yet.

• actionmailbox
  • GHSA-5957-c7qm-m469: Possible signature replay in Action Mailbox Mailgun ingress
• actionpack
  • GHSA-2586-8ghr-69fj: Possible restoration of destroyed sessions in Action Dispatch CacheStore
  • GHSA-2gff-2mmg-m73p: Possible IP spoofing in Action Dispatch RemoteIp
  • GHSA-gmj8-hvj3-49mw: Missing SameSite attribute on session cookies from Action Pack session stores
  • GHSA-r9jg-fmfx-2gv6: Possible cache poisoning in Action Pack content negotiation
  • GHSA-rwvh-fw6r-pwvp: Possible DoS vulnerability in Action Controller Live streaming
  • GHSA-wm3x-v3qw-4jh3: Possible Strong Parameters bypass in Parameters#each_key in Action Pack
  • GHSA-x6mj-8jx9-qhqv: Possible sensitive session information leak in Active Storage proxy mode
• actionview
  • GHSA-2p2f-4rq4-gjwc: Possible XSS vulnerability in Action View text helpers
  • GHSA-68p9-83h6-5wpj: Possible XSS vulnerability in Action View tag helpers
  • GHSA-rq8q-p985-fjq7: Possible XSS vulnerability in Action View strip_tags
  • GHSA-v6rj-xm57-3p59: Possible XSS vulnerability in Action View highlight helper
• activestorage
  • GHSA-3f4q-8x5m-76v8: Possible local file disclosure in Active Storage video previews and analysis
  • GHSA-3w93-6hmw-whh4: Unsigned Content-Type in Active Storage GCS direct uploads with cache_control
  • GHSA-4v2w-w6g6-f8f8: Possible DoS vulnerability in Active Storage proxy mode via storage errors during streaming
  • GHSA-f3w6-w445-fwh9: Possible arbitrary file write and read in Active Storage image analysis
  • GHSA-hfr4-8rjc-97m2: Possible circumvention of file size limits in Active Storage direct uploads to Google Cloud Storage
  • GHSA-p2pm-g2h6-7j5j: Possible DoS vulnerability in Active Storage filename handling
  • GHSA-v924-7rp8-4mxh: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing
• activesupport
  • GHSA-2w9f-fxwj-w2qf: Possible XSS vulnerability in Active Support MessagePack serializer
  • GHSA-8474-xrp6-wh69: Possible DoS vulnerability in Active Support safe_constantize

Details

I copied each file's title, description and CVSS score from its GHSA, and wrapped the description at 80 columns. patched_versions is "~> 8.0.5, >= 8.0.5.2" and ">= 8.1.4.1", or ">= 8.1.4.1" alone where the GHSA affects only 8.1. unaffected_versions covers the releases below a GHSA's lower bound, if the GHSA gives one. related links the rubygems.org versions, the release tags, the patch commits named in the GHSA, and the GHSA itself.

GHSA-x6mj-8jx9-qhqv concerns Active Storage, but the GHSA names actionpack, where the fix is, so its file is under gems/actionpack/.

The GHSA ranges skip the 8.1.0 prereleases: >= 8.1 excludes them, and < 8.0.5.2 stops below them. Where a GHSA affects both 8.0 and 8.1, I marked 8.1.0.beta1 and 8.1.0.rc1 vulnerable, because they fall between vulnerable 8.0 and 8.1 releases.

This is the first Action Mailbox advisory in the database, so gems/actionmailbox/ is new.

[jasnow]

LGTM