`
+ - `onerror` attributes on images: `

`
+ - Other HTML attributes that can execute JavaScript
+
+ ### Patches
+
+ A fix is currently in development. Users should upgrade to version
+ **0.2.1** or later once released. The patch escapes all HTML attribute
+ values using `CGI.escapeHTML` to prevent injection attacks.
+
+ ### Workarounds
+
+ Until a patched version is available, users can implement one or
+ more of these mitigations:
+
+ 1. **Sanitize output**: Pass the HTML output through a sanitization
+ library like [Sanitize](https://github.com/rgrove/sanitize) or
+ [Loofah](https://github.com/flavorjones/loofah):
+
+ ```ruby
+ html = ProsemirrorToHtml.render(document)
+ safe_html = Sanitize.fragment(html, Sanitize::Config::RELAXED)
+ ```
+
+ 2. **Implement Content Security Policy (CSP)**: Add strict CSP
+ headers to prevent inline JavaScript execution:
+ ```
+ Content-Security-Policy: default-src 'self'; script-src 'self'
+ ```
+
+ 3. **Input validation**: If possible, validate and sanitize
+ ProseMirror documents before conversion to prevent malicious
+ content from entering the system.
+
+ ### References
+
+ - Vulnerable code: https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
+ - [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
+ patched_versions:
+ - ">= 0.2.1"
+ related:
+ url:
+ - https://github.com/etaminstudio/prosemirror_to_html/security/advisories/GHSA-52c5-vh7f-26fx
+ - https://github.com/etaminstudio/prosemirror_to_html/commit/4d59f94f550bcabeec30d298791bbdd883298ad8
+ - https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+ - https://github.com/etaminstudio/prosemirror_to_html/blob/ea8beb32f6c37f29f042ba4155ccf18504da716e/lib/prosemirror_to_html.rb#L249
+ - https://github.com/advisories/GHSA-4249-gjr8-jpq3
+---
diff --git a/advisories/_posts/2025-12-08-CVE-2025-66567.md b/advisories/_posts/2025-12-08-CVE-2025-66567.md
index 8236ab43..7344cc0f 100644
--- a/advisories/_posts/2025-12-08-CVE-2025-66567.md
+++ b/advisories/_posts/2025-12-08-CVE-2025-66567.md
@@ -1,41 +1,41 @@
----
-layout: advisory
-title: 'CVE-2025-66567 (ruby-saml): Ruby-saml has a SAML authentication bypass due
- to namespace handling (parser differential)'
-comments: false
-categories:
-- ruby-saml
-advisory:
- gem: ruby-saml
- cve: 2025-66567
- ghsa: 9v8j-x534-2fx3
- url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
- title: Ruby-saml has a SAML authentication bypass due to namespace handling (parser
- differential)
- date: 2025-12-08
- description: |
- ### Summary
-
- Ruby-saml up to and including 1.12.4, there is an authentication
- bypass vulnerability because of an incomplete fix for CVE-2025-25292.
- ReXML and Nokogiri parse XML differently, the parsers can generate
- entirely different document structures from the same XML input.
- That allows an attacker to be able to execute a Signature Wrapping
- attack. The vulnerability does not affect the version 1.18.0.
-
- ### Impact
-
- That allows an attacker to be able to execute a Signature Wrapping
- attack and bypass the authentication
- cvss_v3: 9.1
- cvss_v4: 9.3
- patched_versions:
- - ">= 1.18.0"
- related:
- url:
- - https://nvd.nist.gov/vuln/detail/CVE-2025-66567
- - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
- - https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
- - https://github.com/advisories/GHSA-754f-8gm6-c4r2
- - https://github.com/advisories/GHSA-9v8j-x534-2fx3
----
+---
+layout: advisory
+title: 'CVE-2025-66567 (ruby-saml): Ruby-saml has a SAML authentication bypass due
+ to namespace handling (parser differential)'
+comments: false
+categories:
+- ruby-saml
+advisory:
+ gem: ruby-saml
+ cve: 2025-66567
+ ghsa: 9v8j-x534-2fx3
+ url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
+ title: Ruby-saml has a SAML authentication bypass due to namespace handling (parser
+ differential)
+ date: 2025-12-08
+ description: |
+ ### Summary
+
+ Ruby-saml up to and including 1.12.4, there is an authentication
+ bypass vulnerability because of an incomplete fix for CVE-2025-25292.
+ ReXML and Nokogiri parse XML differently, the parsers can generate
+ entirely different document structures from the same XML input.
+ That allows an attacker to be able to execute a Signature Wrapping
+ attack. The vulnerability does not affect the version 1.18.0.
+
+ ### Impact
+
+ That allows an attacker to be able to execute a Signature Wrapping
+ attack and bypass the authentication
+ cvss_v3: 9.1
+ cvss_v4: 9.3
+ patched_versions:
+ - ">= 1.18.0"
+ related:
+ url:
+ - https://nvd.nist.gov/vuln/detail/CVE-2025-66567
+ - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-9v8j-x534-2fx3
+ - https://github.com/SAML-Toolkits/ruby-saml/commit/e9c1cdbd0f9afa467b585de279db0cbd0fb8ae97
+ - https://github.com/advisories/GHSA-754f-8gm6-c4r2
+ - https://github.com/advisories/GHSA-9v8j-x534-2fx3
+---
diff --git a/advisories/_posts/2025-12-08-CVE-2025-66568.md b/advisories/_posts/2025-12-08-CVE-2025-66568.md
index 8c07766d..72bf2667 100644
--- a/advisories/_posts/2025-12-08-CVE-2025-66568.md
+++ b/advisories/_posts/2025-12-08-CVE-2025-66568.md
@@ -1,52 +1,52 @@
----
-layout: advisory
-title: 'CVE-2025-66568 (ruby-saml): Ruby-saml allows a Libxml2 Canonicalization error
- to bypass Digest/Signature validation'
-comments: false
-categories:
-- ruby-saml
-advisory:
- gem: ruby-saml
- cve: 2025-66568
- ghsa: x4h9-gwv3-r4m4
- url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
- title: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature
- validation
- date: 2025-12-08
- description: |
- ### Summary
-
- Ruby-saml up to and including 1.12.4, there is an authentication
- bypass vulnerability because of an issue at libxml2 canonicalization
- process used by Nokogiri for document transformation. That allows
- an attacker to be able to execute a Signature Wrapping attack.
- The vulnerability does not affect the version 1.18.0.
-
- ### Details
-
- When libxml2’s canonicalization is invoked on an invalid XML input,
- it may return an empty string rather than a canonicalized node.
- ruby-saml then proceeds to compute the DigestValue over this empty
- string, treating it as if canonicalization succeeded.
-
- ### Impact
-
- 1. Digest bypass: By crafting input that causes canonicalization to
- yield an empty string, the attacker can manipulate validation to
- pass incorrectly.
-
- 2. Signature replay on empty canonical form: If an empty string has
- been signed once (e.g., in a prior interaction or via a
- misconfigured flow), that signature can potentially be replayed
- to bypass authentication.
- cvss_v3: 9.1
- cvss_v4: 9.3
- patched_versions:
- - ">= 1.18.0"
- related:
- url:
- - https://nvd.nist.gov/vuln/detail/CVE-2025-66568
- - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
- - https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
- - https://github.com/advisories/GHSA-x4h9-gwv3-r4m4
----
+---
+layout: advisory
+title: 'CVE-2025-66568 (ruby-saml): Ruby-saml allows a Libxml2 Canonicalization error
+ to bypass Digest/Signature validation'
+comments: false
+categories:
+- ruby-saml
+advisory:
+ gem: ruby-saml
+ cve: 2025-66568
+ ghsa: x4h9-gwv3-r4m4
+ url: https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
+ title: Ruby-saml allows a Libxml2 Canonicalization error to bypass Digest/Signature
+ validation
+ date: 2025-12-08
+ description: |
+ ### Summary
+
+ Ruby-saml up to and including 1.12.4, there is an authentication
+ bypass vulnerability because of an issue at libxml2 canonicalization
+ process used by Nokogiri for document transformation. That allows
+ an attacker to be able to execute a Signature Wrapping attack.
+ The vulnerability does not affect the version 1.18.0.
+
+ ### Details
+
+ When libxml2’s canonicalization is invoked on an invalid XML input,
+ it may return an empty string rather than a canonicalized node.
+ ruby-saml then proceeds to compute the DigestValue over this empty
+ string, treating it as if canonicalization succeeded.
+
+ ### Impact
+
+ 1. Digest bypass: By crafting input that causes canonicalization to
+ yield an empty string, the attacker can manipulate validation to
+ pass incorrectly.
+
+ 2. Signature replay on empty canonical form: If an empty string has
+ been signed once (e.g., in a prior interaction or via a
+ misconfigured flow), that signature can potentially be replayed
+ to bypass authentication.
+ cvss_v3: 9.1
+ cvss_v4: 9.3
+ patched_versions:
+ - ">= 1.18.0"
+ related:
+ url:
+ - https://nvd.nist.gov/vuln/detail/CVE-2025-66568
+ - https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-x4h9-gwv3-r4m4
+ - https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
+ - https://github.com/advisories/GHSA-x4h9-gwv3-r4m4
+---
diff --git a/advisories/_posts/2025-12-16-CVE-2025-68113.md b/advisories/_posts/2025-12-16-CVE-2025-68113.md
index a2c324b4..e0ba3873 100644
--- a/advisories/_posts/2025-12-16-CVE-2025-68113.md
+++ b/advisories/_posts/2025-12-16-CVE-2025-68113.md
@@ -1,66 +1,66 @@
----
-layout: advisory
-title: 'CVE-2025-68113 (altcha): ALTCHA Proof-of-Work Vulnerable to Challenge Splicing
- and Replay'
-comments: false
-categories:
-- altcha
-advisory:
- gem: altcha
- cve: 2025-68113
- ghsa: 6gvq-jcmp-8959
- url: https://github.com/altcha-org/altcha-lib/security/advisories/GHSA-6gvq-jcmp-8959
- title: ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
- date: 2025-12-16
- description: |
- ### Impact
-
- A cryptographic semantic binding flaw in ALTCHA libraries allows
- challenge payload splicing, which may enable replay attacks. The
- HMAC signature does not unambiguously bind challenge parameters to
- the nonce, allowing an attacker to reinterpret a valid proof-of-work
- submission with a modified expiration value.
-
- This may allow previously solved challenges to be reused beyond
- their intended lifetime, depending on server-side replay handling
- and deployment assumptions.
-
- The vulnerability primarily impacts abuse-prevention mechanisms such
- as rate limiting and bot mitigation.
-
- It does not directly affect data confidentiality or integrity.
-
- ### Patches
-
- This issue has been addressed by enforcing explicit semantic
- separation between challenge parameters and the nonce during
- HMAC computation.
-
- Users are advised to upgrade to patched versions.
-
- ### Workarounds
-
- As a mitigation, implementations may append a delimiter to the
- end of the `salt` value prior to HMAC computation (for example,
- `
?expires=