Fix guard-livereload security vulnerability #289 by kallal79 · Pull Request #1026 · rubysec/ruby-advisory-db

kallal79 · 2026-03-31T03:21:20Z

Add missing CVE-2016-1000305 advisory for guard-livereload
Fix test validation logic in gem_advisory_example.rb
Resolve 8 failing tests by improving version requirement validation
Handle compound version requirements (e.g., '~> 4.2.5, >= 4.2.5.1')
Add edge case handling for unaffected versions
All 53,803 tests now pass

Fixes #289

- Add missing CVE-2016-1000305 advisory for guard-livereload - Fix test validation logic in gem_advisory_example.rb - Resolve 8 failing tests by improving version requirement validation - Handle compound version requirements (e.g., '~> 4.2.5, >= 4.2.5.1') - Add edge case handling for unaffected versions - All 53,803 tests now pass Fixes rubysec#289

jasnow · 2026-05-14T16:47:40Z

+cvss_v2: 5.0
+cvss_v3: 7.5
+unaffected_versions:
+  - ">= 2.5.2"


This can not be the same as the patched_versions.

indeed, should be "< 2.5.2"

jasnow · 2026-05-15T12:46:38Z

@kallal79 - Add feedback

kallal79 · 2026-05-29T10:19:57Z

Gsoc

jasnow · 2026-05-29T11:52:16Z

Gsoc

Does this mean your are busy with GSOC at the moment?

kallal79 · 2026-05-31T04:23:34Z

Thanks @jasnow and @simi for the feedback. I had submitted a proposal to your org for GSoC under the guidance of my mentor, but since I wasn’t selected I’ve joined another org. Still, I’ll continue contributing here — I’ll make the required changes, commit, and push updates for this PR. If your org had selected me, I would have been able to dedicate full‑time effort. In case there are any paid internships or full‑time opportunities available, please let me know — I’d be very interested in working full‑time with you.

simi · 2026-05-31T10:45:50Z

Thanks @jasnow and @simi for the feedback. I had submitted a proposal to your org for GSoC under the guidance of my mentor, but since I wasn’t selected I’ve joined another org. Still, I’ll continue contributing here — I’ll make the required changes, commit, and push updates for this PR. If your org had selected me, I would have been able to dedicate full‑time effort. In case there are any paid internships or full‑time opportunities available, please let me know — I’d be very interested in working full‑time with you.

Hello @kallal79. Good luck on your GSoC project! This repository is currently fully community maintained. Sadly, there are no paid internships available.

jasnow · 2026-05-31T12:03:16Z

I’ll make the required changes, commit, and push updates for this PR.

Looking forward to your updates.

flavorjones · 2026-05-31T13:37:24Z

Removing "ready to review", the changes already requested have not been made.

jasnow

Please respond to the given comments especially the lack of a CVE or GHSA reference.

jasnow · 2026-05-14T16:52:52Z

        expect(subject).to be_kind_of(String).or(be_nil)
      end
    end



Move this file/changes to separate PR.

jasnow · 2026-06-02T14:55:55Z

+related:
+  url:
+    - https://github.com/guard/guard-livereload/issues/159
+    - https://nvd.nist.gov/vuln/detail/CVE-2016-1000305


This URL does not exist. Please find a GHSA or CVE URL to use to validate this advisory.

…remove dead URL

jasnow · 2026-06-03T13:02:45Z

+  - ">= 2.5.2"
+related:
+  url:
+    - https://security.snyk.io/vuln/SNYK-RUBY-GUARDLIVERELOAD-20361


Please add these references:
https://rubygems.org/gems/guard-livereload/versions/2.5.2
guard/guard-livereload#158
https://github.com/guard/guard-livereload/releases/tag/v2.5.2

simi · 2026-06-03T13:05:20Z

@kallal79 sorry for the noise, please ignore the bot.

jasnow · 2026-06-03T18:22:22Z

+notes: |
+  This vulnerability was assigned CVE-2016-1000305 by the DWF (Distributed Weakness Filing)
+  project. The gem has not been released after fixing this vulnerability in version 2.5.2.
+  Users should consider migrating to rack-livereload as an alternative.


Add CR after line 31 to pass yamllint.

jasnow reviewed May 14, 2026

View reviewed changes

jasnow added the Ready to Review label May 31, 2026

jasnow mentioned this pull request May 31, 2026

guard-livereload security vulnerability #289

Open

flavorjones removed the Ready to Review label May 31, 2026

jasnow requested changes Jun 2, 2026

View reviewed changes

jasnow added the need CVE label Jun 2, 2026

Address PR feedback: revert spec change, update unaffected_versions, …

786171f

…remove dead URL

This comment was marked as spam.

Sign in to view

Merge remote-tracking branch 'origin/master' into pr-1026

9d92680

kallal79 force-pushed the fix-guard-livereload-vulnerability-289 branch from dcd6124 to 0a1bf69 Compare June 3, 2026 04:58

Keep CVE ID and use Snyk URL as requested, remove spec changes

accffa1

kallal79 force-pushed the fix-guard-livereload-vulnerability-289 branch from 0a1bf69 to accffa1 Compare June 3, 2026 05:10

Uh oh!

Conversation

kallal79 commented Mar 31, 2026

Uh oh!

jasnow May 14, 2026

Choose a reason for hiding this comment

Uh oh!

simi May 22, 2026

Choose a reason for hiding this comment

Uh oh!

jasnow commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kallal79 commented May 29, 2026

Uh oh!

jasnow commented May 29, 2026

Uh oh!

kallal79 commented May 31, 2026

Uh oh!

simi commented May 31, 2026

Uh oh!

jasnow commented May 31, 2026

Uh oh!

flavorjones commented May 31, 2026

Uh oh!

jasnow left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jasnow May 14, 2026

Choose a reason for hiding this comment

Uh oh!

jasnow Jun 2, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

This comment was marked as spam.

Uh oh!

jasnow Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

simi commented Jun 3, 2026

Uh oh!

jasnow Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

jasnow commented May 15, 2026 •

edited

Loading

jasnow left a comment •

edited

Loading

jasnow Jun 3, 2026 •

edited

Loading