Advisories for Gem/Geminabox package

A stored cross-site scripting (XSS) vulnerability in geminabox (Gem in a Box) allows attackers to inject arbitrary web script via the homepage value of a .gemspec file, related to views/gem.erb and views/index.erb.

geminabox (aka Gem in a Box) has an XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.

geminabox (aka Gem in a Box) is vulnerable to CSRF.