rubygems package report

Is ruby-saml safe?

9 known vulnerabilities, worst severity CRITICAL.

cvss

9.3

how bad it is if exploited, out of 10

epss

0.20%

chance of exploitation in the next 30 days

xyz score

4.0

CyberXYZ composite, out of 10

fig. 01 — GHSA-x4h9-gwv3-r4m4, the advisory selected below

// advisories

GHSA-x4h9-gwv3-r4m4

CRITICALCVE-2025-66568

Ruby-saml up to and including 1.12.4, there is an authentication bypass vulnerability because of an issue at libxml2 canonicalization process used by Nokogiri for document transformation. That allows an attacker to be able to execute a Signature Wrapping attack. The vulnerability does not affect the version 1.18.0.

Affected: < 1.18.0
Fixed in: 1.18.0
Weakness: CWE-347
Published: 2025-12-08
Source: github

GHSA NVD MITRE reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so rubygems packages are not covered.

Checked 2026-09-22 at 01:41 UTC. The most recent advisory here was published 2025-12-08. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is ruby-saml safe? rubygems package security report | CyberXYZ