I think there may be a problem in Gemfile.lock around line 223.
The json gem version 2.18.1 includes a format string injection bug (CVE‑2026‑33210) triggered when parsing untrusted JSON with allow_duplicate_key: false. This can lead to denial of service or information disclosure. Upgrading to a patched version (≥2.19.2) removes the vulnerability.
Something like this might fix it:
Update Gemfile to require json >=2.19.2 (e.g., gem 'json', '>= 2.19.2') and run bundle update json.
For reference: rule CVE-2026-33210. Rated critical.
If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
I think there may be a problem in
Gemfile.lockaround line 223.The json gem version 2.18.1 includes a format string injection bug (CVE‑2026‑33210) triggered when parsing untrusted JSON with allow_duplicate_key: false. This can lead to denial of service or information disclosure. Upgrading to a patched version (≥2.19.2) removes the vulnerability.
Something like this might fix it:
For reference: rule
CVE-2026-33210. Rated critical.If I have misread how this is used, sorry for the noise — feel free to close.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.