Read the docs
TI-2015-08083 Aliases CVE-2015-20108GHSA-r364-2pj4-pf7f

xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and…

Priority MEDIUM 52CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01332 71st percentileScored 2026-11-07
Fix Fixed ruby-saml (RubyGems): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ruby-saml (RubyGems)before 1.0.01.0.0Patch availableGHSA-r364-2pj4-pf7f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ruby-saml (RubyGems) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-r364-2pj4-pf7f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:*before 1.0.0VulnerableSAML-Toolkits
  • cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·SAML-Toolkits

Remediation

  • Fix · GHSA-r364-2pj4-pf7f ruby-saml (RubyGems) Fixed in 1.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-20108
  2. 2026-10-03 Alias added: GHSA-r364-2pj4-pf7f

References

Patch 2

Advisory 2

Other 5

  • TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
  • TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2025-40979 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVSS 4.0CRITICAL 9.3
  • TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
  • TI-2017-08453 Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal CVSS 3.0CRITICAL 9.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences