ruby-advisory-db - A database of vulnerable Ruby Gems

项目说明

Ruby Ad Database

The Ruby Ad Database is a community effort to compile all security
ad that are relevant to Ruby libraries.
We expect others to create the data, such as getting CVE's, GHSA's,
OSVDB's, cvss', or original information.
More details at HERE.

You can check your own Gemfile.locks against this database by using
[bundler-audit].

Support Ruby Security!

Do you know about a that isn't listed in this database? Open an
issue or submit a PR.

Directory Structure

The database is a list of directories that match the names of Ruby libraries on
[rubygems.org]. Within each directory are one or more ad files
for the Ruby library. These ad files are named using
the ad' [CVE] or [GHSA] or [OSVDB] (legacy) identifier number.

gems/

The gems/ directory contains sub-directories that match the names of the Ruby
libraries on [rubygems.org]. Within each directory are one or more ad
files for the Ruby library. These ad files are named using the
ad' [CVE] or [GHSA] ID.

rubies/

The rubies/ directory contains sub-directories for each Ruby implementation.
Within each directory are one or more ad files for the Ruby
implementation. These ad files are named using the ad' [CVE]
or [GHSA] ID.

Examples

Each ad file contains the ad information in [YAML] format.
Here are some example ad:

gems/actionpack/C.yml

rubies/ruby/C.yml

YAML Schema

gems

* gem \[String\] (required): Name of the affected gem.
* library \[String\] (optional): Name of the ruby library which the
affected gem belongs to.
* framework \[String\] (optional): Name of the framework which the
affected gem belongs to. (e.g. rails)
* platform \[String\] (optional): If this is platform-specific,
name of platform this affects (e.g. jruby)
* cve \[String\] (optional): Common and Exposures (CVE) ID.
* osvdb \[Integer\] (optional): Open Sourced Database (OSVDB) ID.
* ghsa \[String\] (optional): GitHub Security Ad (GHSA) ID.
* url \[String\] (required): The URL to the full ad.
* title \[String\] (required): The title of the ad or indi
. It must be a single line sentence.
* Line wrap title: field at 80.
* date \[Date\] (required): The public disclosure date of the ad.
* description \[String\] (required): One or more paragraphs describing the
. It may contain multiple paragraphs.
* Used description: | if it is more than one sentence/line.
* Line wrap descriptions: field at 80.
* Do not include "POC", "PoC", or "Proof of Concept" heading sections
(any casing) in the description: field.
* Not use "\n" or "%" in description: field.
* c \[Float\] (optional): The [CVSSv2] score for the .
* c \[Float\] (optional): The [CVSSv3] score for the .
* c \[Float\] (optional): The [CVSSv4] score for the .
* unaffected_ \[Array\<String\>\] (optional): The requirements for the
unaffected of the Ruby library.
* unaffected_ ranges must be quoted (ex: ">= 1.2.3").
* patched_ \[Array\<String\>\] (optional): The requirements
for the patched of the Ruby library.
* patched_ ranges must be quoted (ex: ">= 1.2.3").
* Omit patched_: if you have no patched identifiers.
* related \[Hash\<Array\<String\>\>\] (optional): Sometimes an ad
references many urls and other identifiers. Supported keys:
cve, ghsa, osvdb, and url
* All supported keys are 4 blanks from left margin.
* cve, ghsa, and osvdb related fields are not URLs.
* notes \[String\] (optional): Internal notes regarding the 's
inclusion in this database.

rubies

* engine \[ruby | mruby | jruby | truffleruby\] (required): Name
of the affected Ruby implementation.
* platform \[String\] (optional): If this is platform-specific,
name of platform this affects (e.g. jruby)
* cve \[String\] (optional): Common and Exposures (CVE) ID.
* osvdb \[Integer\] (optional): Open Sourced Database (OSVDB) ID.
* ghsa \[String\] (optional): GitHub Security Ad (GHSA) ID.
* url \[String\] (required): The URL to the full ad.
* title \[String\] (required): The title of the ad or indi
. It must be a single line sentence.
* Line wrap title: field at 80.
* date \[Date\] (required): The public disclosure date of the ad.
* description \[String\] (required): One or more paragraphs describing the
. It may contain multiple paragraphs.
* Used description: | (not |-) if it is more than one sentence/line.
* Line wrap descriptions: field at 80.
* Not use "\n" or "%" in description: field.
* Do not include "POC", "PoC", or "Proof of Concept" heading sections
(any casing) in the description: field.
* c \[Float\] (optional): The [CVSSv2] score for the .
* c \[Float\] (optional): The [CVSSv3] score for the .
* c \[Float\] (optional): The [CVSSv4] score for the .
* unaffected_ \[Array\<String\>\] (optional): The requirements
for the unaffected of the Ruby implementation.
* Field unaffected_ are 2 blanks from left margin.* cve, ghsa, and osvdb related fields are not URLs.
* patched_ \[Array\<String\>\] (optional): The requirements
for the patched of the Ruby implementation.
* patched_/unaffected_ ranges must be quoted
(ex: ">= 1.2.3").
* Field patched_are 2 blanks from left margin.
* Omit patched_: if you have no patched identifiers.
* related \[Hash\<Array\<String\>\>\] (optional): Sometimes an ad
references many urls and other identifiers. Supported keys:
cve, ghsa, osvdb, and url
* All supported keys are 4 blanks from left margin.
* cve, ghsa, and osvdb related fields are not URLs.
* notes \[String\] (optional): Internal notes regarding the 's
inclusion in this database.

General Contributing Guidelines

* Ad file name
* Preference is CVE or GHSA o file naming.
* Should be equal to root url: field value.
* For post-2016 ad, use only "published" or "reserved" C are found at one of these web sites:
*
*
* All text should be wrapped at 80 columns.
* YAML must be indented by 2 spaces.
* Ruby YAML does not like embedded ":" characters.
* For more info:
* Github Action workflow
* Run rspec spec/schema_.rb for additional lint checks.
* Check all URLs for dead links.
* If a URL is dead, check if has a copy, and link to that.

Tests

Prior to submitting a pull request, run the tests:

GitHub Security Ad Sync (GHSA)

* The usual GHSA/SYNC workflow is:
1. Run "GH_API_TOKEN=GITHUB_TOKEN_VALUE bundle exec rake sync_github_ad" ruby script.
- The rake task will write YAML files for any missing ad.
- Then it runs "./lib/rad-ignores.sh" shell script to
ignore duplicate ad.
- Then it runs "yamllint" for all gems and rubies yml files.
- More details follow this paragraph.

2. Run "rake" to run the lint checks.

3. If new or modified ad, submit a PR to the repo.
4. CAVEAT: Between steps 2 and 5, you might need to manually edit the files.

There is a script that will create initial YAML files for RubyGem ad
which are in the [GitHub Security Ad API], but are not already in this
dataset. This script can be periodically run to ensure this repo has all the
data that is present in the GitHub Security Ad data.

The GitHub Security Ad API requires a token to access it.

* It can be a completely scope-less token (recommended); it does not require any
permissions at all.
* Get yours at:

To run the GitHub Security Ad sync to retrieve all ad, start by executing
the rake task:

Or, to only retrie for a single gem:

Rails LTS

The maintainers of [Rails LTS] ha us not to track the Rails LTS ][PR-847].
If you are using [Rails LTS] and [bundler-audit], it is advised that you should
add the [List of C by Rails LTS] to your .bundler-audit.yml file
under ignore:`.

[Rails LTS]:
[List of C by Rails LTS]:
[PR-847]:

Policy on Generative AI Contributions

To safeguard project security and respect our maintainers' time, a human-in-the-loop is strictly required for all submissions. While AI tools are permitted as assistants, contributors must personally review, understand, and take full responsibility for their work. Any contributions that appear to be unre machine output will be closed immediately, and repeat offenders will be banned from the project and reported.

Credits

Please see [CONTRIBUTORS.md].

This database also includes data from the [Open Sourced Database][OSVDB]
de by the Open Security Foundation (OSF) and its contributors.

[rubygems.org]:
[bundler-audit]:
[CVE]:
[OSVDB]:
[GHSA]:
[GitHub Security Ad API]:
[CVSSv2]:
[CVSSv3]:
[CVSSv4]:
[YAML]:
[CONTRIBUTORS.md]:

项目信息

开发语言：Ruby

Star 数：1074

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A database of vulnerable Ruby Gems展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。