carrierwave (RubyGems)
Advisories
10
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.1.3 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update carrierwave # Gemfile: gem "carrierwave", ">= 3.1.3"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-7g26-2qgj-chfg CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters |
Medium EPSS 0.22% |
>= 3.0.0.beta, < 3.1.3 | 3.1.3 |
| GHSA-7g26-2qgj-chfg CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters |
Medium EPSS 0.22% |
< 2.2.7 | 2.2.7 |
| GHSA-vfmv-jfc5-pjjw CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained |
Medium EPSS 0.44% |
< 2.2.6 | 2.2.6 |
| GHSA-vfmv-jfc5-pjjw CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained |
Medium EPSS 0.44% |
>= 3.0.0, < 3.0.7 | 3.0.7 |
| GHSA-gxhx-g4fq-49hj CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS |
Medium EPSS 0.61% |
>= 3.0.0, < 3.0.5 | 3.0.5 |
| GHSA-gxhx-g4fq-49hj CarrierWave Content-Type allowlist bypass vulnerability, possibly leading to XSS |
Medium EPSS 0.61% |
< 2.2.5 | 2.2.5 |
| GHSA-cf3w-g86h-35x4 Code Injection vulnerability in CarrierWave::RMagick |
High EPSS 12.68% |
< 1.3.2 | 1.3.2 |
| GHSA-cf3w-g86h-35x4 Code Injection vulnerability in CarrierWave::RMagick |
High EPSS 12.68% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-fwcm-636p-68r5 Server-side request forgery in CarrierWave |
Medium EPSS 1.17% |
>= 2.0.0, < 2.1.1 | 2.1.1 |
| GHSA-fwcm-636p-68r5 Server-side request forgery in CarrierWave |
Medium EPSS 1.17% |
< 1.3.2 | 1.3.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor