spree (RubyGems)
Advisories
13
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.4.3 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update spree # Gemfile: gem "spree", ">= 5.4.3"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xf4v-w5x5-pv79 Spree: CSV Formula Injection in Customer Export |
Medium | >= 5.2.0, < 5.2.8 | 5.2.8 |
| GHSA-xf4v-w5x5-pv79 Spree: CSV Formula Injection in Customer Export |
Medium | >= 5.4.0, < 5.4.3 | 5.4.3 |
| GHSA-xf4v-w5x5-pv79 Spree: CSV Formula Injection in Customer Export |
Medium | >= 5.3.0, < 5.3.6 | 5.3.6 |
| GHSA-x485-rhg3-cqr4 Spree Commerce is vulnerable to RCE through Search API |
Critical EPSS 3.76% |
>= 0.30.0.beta1, < 0.50.0 | 0.50.0 |
| GHSA-97vm-c39p-jr86 Spree has Remote Command Execution vulnerability in search functionality |
Critical EPSS 5.80% |
< 0.60.2 | 0.60.2 |
| GHSA-7h48-m3rw-vr27 Spree does not properly restrict the use of a hash to provide values for a model's attributes |
Medium EPSS 1.23% |
< 0.4.0 | 0.4.0 |
| GHSA-g466-57gh-cqfw Spree uses a hardcoded hash value |
Medium EPSS 1.23% |
< 0.4.0 | 0.4.0 |
| GHSA-hwrx-wc75-mgh7 Spree allows remote attackers to obtain sensitive information |
Medium EPSS 2.53% |
>= 0.11.0, < 0.11.2 | 0.11.2 |
| GHSA-hwrx-wc75-mgh7 Spree allows remote attackers to obtain sensitive information |
Medium EPSS 2.53% |
>= 0.30.0.beta1, < 0.30.0 | 0.30.0 |
| GHSA-f8cm-364f-q9qh Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls |
High EPSS 1.06% |
>= 4.0.0, < 4.0.4 | 4.0.4 |
| GHSA-f8cm-364f-q9qh Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls |
High EPSS 1.06% |
>= 4.1.0, < 4.1.11 | 4.1.11 |
| GHSA-f8cm-364f-q9qh Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls |
High EPSS 1.06% |
< 3.7.11 | 3.7.11 |
| GHSA-jxx8-v83v-rhw3 Spree Improper Input Validation vulnerability |
Medium EPSS 1.53% |
>= 1.0.0, < 2.0.0.rc1 | 2.0.0.rc1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor