Three new alchemy_cms gem advisories

gems/alchemy_cms/GHSA-7m8w-vg9p-qjr6.yml

@@ -0,0 +1,38 @@
+---
+gem: alchemy_cms
+ghsa: 7m8w-vg9p-qjr6
+url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-7m8w-vg9p-qjr6
+title: Stored XSS in SelectView via Missing Server-Side Option Validation
+date: 2026-07-22
+description: |
+  ## Summary
+
+  Alchemy::Ingredients::SelectView#call delegates to super (i.e.,
+  Alchemy::Ingredients::BaseView#call) for the single-value path, which
+  returns value.html_safe. The allowed option list (select_values)
+  defined in elements.yml is enforced only in the admin UI dropdown;
+  no server-side validation checks that a submitted value belongs to
+  the allowed set. An authenticated CMS author can bypass the dropdown
+  by sending a direct API request with an arbitrary HTML string as the
+  ingredient value. That string is stored verbatim and rendered unescaped
+  into the published public page, executing in every visitor's browser.
+cvss_v3: 5.4
+patched_versions:
+  - "~> 8.0.16"
+  - "~> 8.1.15"
+  - "~> 8.2.9"
+  - ">= 8.3.5"
+related:
+  url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.5
+      - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.5
+        - https://github.com/AlchemyCMS/alchemy_cms/pull/4081
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.9
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.15
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.16
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-7m8w-vg9p-qjr6
+notes: |
+  - No CVE value in project GHSA
+  - cvss_v3 from project GHSA
+  - Changelog only goes to 8.3.0.
+  - date from rubygems.or 8.3.5 release date

gems/alchemy_cms/GHSA-pm72-wq9v-wvfh.yml

@@ -0,0 +1,36 @@
+---
+gem: alchemy_cms
+ghsa: pm72-wq9v-wvfh
+url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh
+title: Stored XSS in PictureView figcaption via html_safe on User Caption
+date: 2026-07-22
+description: |
+  ## Summary
+
+  Alchemy::Ingredients::PictureView#caption calls ingredient.caption.html_safe
+  and passes the result to content_tag(:figcaption, ...). The caption
+  value is user-supplied (set via the ingredients_attributes[caption]
+  parameter in the element save API) and is stored in a JSON data column
+  with no sanitization. Because .html_safe is called before content_tag,
+  Rails' automatic HTML escaping is suppressed and the raw user string
+  is emitted into the published page, executing in every visitor's browser.
+cvss_v3: 5.4
+patched_versions:
+  - "~> 8.0.16"
+  - "~> 8.1.15"
+  - "~> 8.2.9"
+  - ">= 8.3.5"
+related:
+  url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.5
+      - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.5
+        - https://github.com/AlchemyCMS/alchemy_cms/pull/4081
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.9
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.15
+    - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.16
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh
+notes: |
+  - No CVE in project GHSA
+  - cvss_v3 from project GHSA
+  - Changelog only goes to 8.3.0.
+  - date from rubygems.or 8.3.5 release date

gems/alchemy_cms/GHSA-r827-6rm4-59pg.yml

@@ -0,0 +1,37 @@
+---
+gem: alchemy_cms
+ghsa: r827-6rm4-59pg
+url: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-r827-6rm4-59pg
+title: Stored XSS via unsanitized SVG attachment replacement
+date: 2026-07-28
+description: |
+  ## Summary
+
+  AlchemyCMS registers its SVG sanitizer (SanitizeSvgJob, a Loofah-based
+  scrubber) only as an after_create_commit callback on Alchemy::Attachment /
+  Alchemy::Picture. This callback fires when a new attachment record is
+  created, but not when an existing attachment's file is replaced through
+  the admin "update" action. An authenticated user holding the editor
+  role (i.e. manage Alchemy::Attachment permission, a low-privilege,
+  non-admin role) can PATCH an existing attachment to replace its file
+  with a malicious SVG containing <script> / onload= payloads. Because
+  the sanitizer never runs on this path, and because AlchemyCMS explicitly
+  configures SVG as an inline-servable content type on Active Storage,
+  the public, unauthenticated /attachment/:id/show route streams the
+  attacker's raw SVG payload with Content-Disposition: inline. Any
+  visitor (including other admins) who opens the attachment URL executes
+  attacker-controlled JavaScript in the AlchemyCMS application origin.
+
+  This is a stored, privilege-crossing Cross-Site Scripting vulnerability,
+  confirmed both by static code review and by live dynamic reproduction
+  against an unmodified AlchemyCMS instance.
+cvss_v3: 8.7
+patched_versions:
+  - ">= 8.3.6"
+related:
+  url:
+    - https://rubygems.org/gems/alchemy_cms/versions/8.3.6
+    - https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-r827-6rm4-59pg
+notes: |
+  - cvss_v3 from project GHSA
+  - No CVE in project GHSA