[GHSA-wmq2-jc9m-xp4m] Cross-site Scripting in in JRuby

[yusuke-koyoshi]

Updates

• Affected products

Comments
The current advisory lists only org.jruby:jruby-core (< 1.4.1) as affected, but this is inaccurate on two points:

1. The jruby-core Maven artifact did not exist at the time of this vulnerability. JRuby was published under the coordinates org.jruby:jruby until the core was split out around JRuby 1.7 (2012). No org.jruby:jruby-core artifact prior to 1.4.1 has ever been published, so the current affected range cannot match any real artifact in a user's dependency graph. The correct coordinate for pre-1.4.1 JRuby is org.jruby:jruby (< 1.4.1).

2. The actual vulnerable code lives in org.jruby.jcodings:jcodings, not in JRuby itself. The upstream JRuby advisory ( https://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html ) states that "the fix was applied to the jcodings library which JRuby uses" and instructs users to replace the bundled jcodings.jar with jcodings 1.0.3. JRuby 1.4.1 shipped fixed simply by bundling jcodings 1.0.3. As a result, any project that consumes org.jruby.jcodings:jcodings at a version < 1.0.3 — directly, or transitively via joni or other libraries — is affected, even when JRuby itself is not on the classpath.

Proposed changes:

• Replace org.jruby:jruby-core (< 1.4.1) with org.jruby:jruby (< 1.4.1).
• Add org.jruby.jcodings:jcodings (< 1.0.3) as an additional affected Maven package.

This will prevent SCA tools relying on GHSA from missing projects that depend on a vulnerable jcodings without going through JRuby.

[Copilot]

Pull request overview

Corrects the Maven packages affected by JRuby’s UTF-8 handling vulnerability.

Changes:

• Replaces the nonexistent vulnerable jruby-core range with org.jruby:jruby.
• Adds affected jcodings versions below 1.0.3.
• Updates the advisory modification timestamp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.