Thwin_Htet

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 18.9 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 through 19.3.0 **Description** An authenticated user with developer-role permissions can execute arbitrary commands within a CI context. This occurs because the Duo Claude AI agent processes configuration from a user-controlled source, allowing the injection of untrusted configuration to pull functionality from an untrusted control sphere. This can lead to unauthorized manipulation of the CI system. **Recommendations** Update GitLab EE versions 18.9 through 19.1.6 to version 19.1.7. Update GitLab EE versions 19.2 through 19.2.4 to version 19.2.5. Update GitLab EE versions 19.3 through 19.3.0 to version 19.3.1.

**Name of the Vulnerable Software and Affected Versions** Rails versions prior to 8.1.2.1 Rails versions prior to 8.0.4.1 Rails versions prior to 7.2.3.1 **Description** Active Storage, used for attaching cloud and local files in Rails applications, is susceptible to a denial-of-service condition. The proxy controller within Active Storage does not restrict the number of byte ranges specified in an HTTP Range header. An attacker can exploit this by sending a request containing a large number of small ranges, leading to excessive CPU usage and potentially causing a denial of service. **Recommendations** Update to Rails version 8.1.2.1 or later. Update to Rails version 8.0.4.1 or later. Update to Rails version 7.2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** Trix editor versions prior to 2.1.4 **Description** The issue is related to a bypass of a previous fix, allowing an attacker to execute arbitrary JavaScript code within the context of the user's session when pasting malicious code. This occurs because the Trix editor only checks the content type on the paste event's `dataTransfer` object and uses the attachment content to set the attachment element's `innerHTML`, even if the attachment itself doesn't have a `text/html` content type. An attacker could trick a user into copying and pasting malicious code, potentially leading to unauthorized actions or sensitive information disclosure. **Recommendations** To resolve the issue, users should upgrade to Trix editor version 2.1.4 or later, which incorporates proper sanitization of input from copied content. Additionally, enhancing the Content Security Policy (CSP) to disallow inline scripts can significantly mitigate the risk of such vulnerabilities. Set CSP policies such as `script-src 'self'` to ensure that only scripts hosted on the same origin are executed, and explicitly prohibit inline scripts using `script-src-elem`. If affected users can disallow browsers that don't support a Content Security Policy, this would be an effective workaround for this and all XSS vulnerabilities.