From dc2d6b293b79b65da2074d9bcc21acd3c2f19aa3 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:47:13 -0400
Subject: [PATCH] Redid existing activeadmin gem; swapped dup for now

---
 gems/activeadmin/CVE-2023-51763.yml | 32 ++++++++++++++++++++++++-----
 1 file changed, 27 insertions(+), 5 deletions(-)

diff --git a/gems/activeadmin/CVE-2023-51763.yml b/gems/activeadmin/CVE-2023-51763.yml
index 2387a84096..717497aaeb 100644
--- a/gems/activeadmin/CVE-2023-51763.yml
+++ b/gems/activeadmin/CVE-2023-51763.yml
@@ -1,21 +1,43 @@
 ---
 gem: activeadmin
+framework: rails
 cve: 2023-51763
-ghsa: rqxc-9p8h-xqgq
-url: https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+ghsa: xhvv-3jww-c487
+url: https://nvd.nist.gov/vuln/detail/CVE-2023-51763
 title: ActiveAdmin vulnerable to CSV injection
 date: 2023-12-24
 description: |
-  csv_builder.rb in ActiveAdmin (aka Active Admin)
-  before 3.2.0 allows CSV injection.
-cvss_v3: 8.4
+  In ActiveAdmin versions prior to 3.2.0, maliciously crafted spreadsheet
+  formulas could be uploaded as part of admin data that, when exported
+  to a CSV file and the imported to a spreadsheet program like libreoffice,
+  could lead to remote code execution and private data exfiltration.
+
+  The attacker would need privileges to upload data to the same
+  ActiveAdmin application as the victim, and would need the victim
+  to possibly ignore security warnings from their spreadsheet program.
+cvss_v3: 9.8
 patched_versions:
   - ">= 3.2.0"
 related:
+  ghsa:
+    - rqxc-9p8h-xqgq
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-51763
+    - https://rubygems.org/gems/activeadmin/versions/3.2.0
+    - https://github.com/activeadmin/activeadmin/blob/master/CHANGELOG.md#320-
     - https://github.com/activeadmin/activeadmin/releases/tag/v3.2.0
+    - https://github.com/activeadmin/activeadmin/pull/8167
+    - https://github.com/activeadmin/activeadmin/commit/7af735cf657c73734fca1900cd6a5adac4ee706e
     - https://github.com/activeadmin/activeadmin/pull/8161
     - https://github.com/activeadmin/activeadmin/commit/697be2b183491beadc8f0b7d8b5bfb44f2387909
+    - https://jzee-rx.medium.com/cve-2023-51763-csv-injection-in-activeadmin-a-security-research-breakdown-d5b0d3663aa4
     - https://github.com/activeadmin/activeadmin/security/advisories/GHSA-xhvv-3jww-c487
+    - https://github.com/advisories/GHSA-xhvv-3jww-c487
+notes: |
+  - date, cvss_v3, related/url's from nvd.nist.gov URL.
+  - description from GHSA URL.
+  - GHSA: cvss_v3 is 5.4 (not used above).
+  - Treating GHSA-rqxc-9p8h-xqgq as the duplicate as GHSA does.
     - https://github.com/advisories/GHSA-rqxc-9p8h-xqgq
+  - Note that the repo security advisory does not have a
+    patch release but GHSA does.