Advisories for Gem/Activeadmin package

Users settings their active admin form legends dynamically may be vulnerable to stored XSS, as long as its value can be injected directly by a malicious user. For example: A public web application allows users to create entities with arbitrary names. Active Admin is used to administrate these entities through a private backend. The form to edit these entities in the private backend has the following shape (note the dynamic …

Impact In ActiveAdmin versions prior to 2.12.0, a concurrency issue was found that could allow a malicious actor to be able to access potentially private data that belongs to another user. The bug affects the functionality to export data as CSV files, and was caused by a variable holding the collection to be exported being shared across threads and not properly synchronized. The attacker would need access to the same …

csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.