From d9421359f47b4125db1f2c40a1a67b09750d6884 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 15:23:04 +0200 Subject: [PATCH 1/6] GHSA-623h-px8r-9643 --- .../_posts/2026-08-30-GHSA-623h-px8r-9643.markdown | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown new file mode 100644 index 0000000..de73f9b --- /dev/null +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -0,0 +1,14 @@ +--- +layout: post +title: "XSS in comment notification email (GHSA-623h-px8r-9643)" +date: 2026-08-30 00:00:00 +0200 +category: security +--- + +Hello, + +[@mikelolasagasti](https://github.com/mikelolasagasti) found XSS in +comment notification email. + +This advisory is assigned [GHSA-623h-px8r-9643](https://github.com/errbit/errbit/security/advisories/GHSA-623h-px8r-9643). +It will be published later. CVE is pending. From 6de76510387e3632ab4415ac750fab1b7a8aa896 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 15:48:35 +0200 Subject: [PATCH 2/6] Update --- .../2026-08-30-GHSA-623h-px8r-9643.markdown | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown index de73f9b..971ecdd 100644 --- a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -8,7 +8,21 @@ category: security Hello, [@mikelolasagasti](https://github.com/mikelolasagasti) found XSS in -comment notification email. +the comment notification email. This advisory is assigned [GHSA-623h-px8r-9643](https://github.com/errbit/errbit/security/advisories/GHSA-623h-px8r-9643). It will be published later. CVE is pending. + +Affected code: + +```erb +# app/views/mailer/comment_notification.html.erb + +<%= @comment.body.to_s.gsub("\n", "
").html_safe %> +``` + +Fixed version: + +```erb +<%= simple_format(@comment.body) %> +``` From e029f9d24d6b2eaa314f950d56417a6490bf691f Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 15:55:21 +0200 Subject: [PATCH 3/6] Update --- blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown index 971ecdd..fddf571 100644 --- a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -26,3 +26,10 @@ Fixed version: ```erb <%= simple_format(@comment.body) %> ``` + +Fix in PR: [https://github.com/errbit/errbit/pull/3094](https://github.com/errbit/errbit/pull/3094) + +Fix released in Errbit version: v0.11.5. + +Workaround: Make sure that you are using email client that properly +sanitize HTML body of email. From 10b78cb35eefdb9dfbd71b561bb744e318e3b345 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 15:59:40 +0200 Subject: [PATCH 4/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown index fddf571..a1e49dd 100644 --- a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -11,8 +11,7 @@ Hello, the comment notification email. This advisory is assigned [GHSA-623h-px8r-9643](https://github.com/errbit/errbit/security/advisories/GHSA-623h-px8r-9643). -It will be published later. CVE is pending. - +CVE is pending. Affected code: ```erb From dc3ae962ba859f7e71a8dea1e04ac375dd42f80a Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 15:59:50 +0200 Subject: [PATCH 5/6] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown index a1e49dd..b614bde 100644 --- a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -30,5 +30,5 @@ Fix in PR: [https://github.com/errbit/errbit/pull/3094](https://github.com/errbi Fix released in Errbit version: v0.11.5. -Workaround: Make sure that you are using email client that properly -sanitize HTML body of email. +Workaround: Make sure that you are using an email client that properly +sanitizes the HTML body of the email. From f96634d20632f29085103d6a2b4160c8145f7cd8 Mon Sep 17 00:00:00 2001 From: Igor Zubkov Date: Sun, 30 Aug 2026 16:22:49 +0200 Subject: [PATCH 6/6] Update --- blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown | 2 ++ 1 file changed, 2 insertions(+) diff --git a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown index b614bde..416a980 100644 --- a/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown +++ b/blog/_posts/2026-08-30-GHSA-623h-px8r-9643.markdown @@ -11,7 +11,9 @@ Hello, the comment notification email. This advisory is assigned [GHSA-623h-px8r-9643](https://github.com/errbit/errbit/security/advisories/GHSA-623h-px8r-9643). + CVE is pending. + Affected code: ```erb