GHSA/SYNC: 4 updated existing advisories + updated rad-ignores.sh script

gems/crass/GHSA-6jxj-px6v-747w.yml

@@ -1,5 +1,6 @@
 ---
 gem: crass
+cve: 2026-61846
 ghsa: 6jxj-px6v-747w
 url: https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
 title: Deeply nested CSS blocks and functions can trigger a
@@ -17,9 +18,13 @@ patched_versions:
   - ">= 1.0.7"
 related:
   url:
+    - https://www.cve.org/CVERecord?id=CVE-2026-61846
     - https://rubygems.org/gems/crass/versions/1.0.7
     - https://github.com/rgrove/crass/releases/tag/v1.0.7
     - https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md#107-2026-06-25
+    - https://github.com/rgrove/crass/commit/cf68287356ec6e20d51cfc4a2d0c3912b7334e99
+    - https://advisories.gitlab.com/gem/crass/CVE-2026-61846
     - https://github.com/rgrove/crass/security/advisories/GHSA-6jxj-px6v-747w
+    - https://github.com/advisories/GHSA-6jxj-px6v-747w
 notes: |
-  - No CVE, but not published so no non-GHSA cvss values.
+  - CVE from GHSA URL, reserved but not published.

gems/crass/GHSA-8vfg-2r28-hvhj.yml

@@ -1,5 +1,6 @@
 ---
 gem: crass
+cve: 2026-61848
 ghsa: 8vfg-2r28-hvhj
 url: https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
 title: Non-ASCII characters cause superlinear CPU consumption
@@ -17,9 +18,14 @@ patched_versions:
   - ">= 1.0.7"
 related:
   url:
+    - https://www.cve.org/CVERecord?id=CVE-2026-61848
     - https://rubygems.org/gems/crass/versions/1.0.7
     - https://github.com/rgrove/crass/releases/tag/v1.0.7
     - https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md#107-2026-06-25
+    - http://github.com/rgrove/crass/commit/da29664648bf80a97a6439e030a4814291c9afa5
+    - https://advisories.gitlab.com/gem/crass/CVE-2026-61848
     - https://github.com/rgrove/crass/security/advisories/GHSA-8vfg-2r28-hvhj
+    - https://github.com/advisories/GHSA-8vfg-2r28-hvhj
 notes: |
-  - No CVE, but not published so no non-GHSA cvss values.
+  - cvss_v4 from GHSA URL.
+  - CVE from GHSA URL, reserved but not published.

gems/crass/GHSA-wwpr-jff3-395c.yml

@@ -1,5 +1,6 @@
 ---
 gem: crass
+cve: 2026-61847
 ghsa: wwpr-jff3-395c
 url: https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
 title: A large number of adjacent CSS comments can trigger a
@@ -18,9 +19,13 @@ patched_versions:
   - ">= 1.0.7"
 related:
   url:
+    - https://www.cve.org/CVERecord?id=CVE-2026-61847
     - https://rubygems.org/gems/crass/versions/1.0.7
     - https://github.com/rgrove/crass/releases/tag/v1.0.7
     - https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md#107-2026-06-25
+    - https://github.com/rgrove/crass/commit/25d78cc607c54262e9d43ea1930f3ba5bb03dfb5
+    - https://advisories.gitlab.com/gem/crass/CVE-2026-61847
     - https://github.com/rgrove/crass/security/advisories/GHSA-wwpr-jff3-395c
+    - https://github.com/advisories/GHSA-wwpr-jff3-395c
 notes: |
-  - No CVE, but not published so no non-GHSA cvss values.
+  - CVE from GHSA URL, reserved but not published.

gems/shopify_app/GHSA-6j52-38f8-qhxr.yml

@@ -1,5 +1,6 @@
 ---
 gem: shopify_app
+cve: 2026-63414
 ghsa: 6j52-38f8-qhxr
 url: https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
 title: Token exchange shop context confusion may allow cross-shop
@@ -32,18 +33,27 @@ description: |
     parameter for bootstrap or routing use cases only.
   * Token-exchange requests are rejected with `401 Unauthorized` when
     the requested shop does not match the authenticated shop.
+
+  ## Credit
+
+  This issue was responsibly reported by Hackerone researcher
+  [leqtuer](https://hackerone.com/leqtuer?type=user).
+cvss_v4: 7.6
 unaffected_versions:
   - "< 22.1.0"
 patched_versions:
   - ">= 23.0.3"
 related:
   url:
+    - https://www.cve.org/CVERecord?id=CVE-2026-63414
     - https://rubygems.org/gems/shopify_app/versions/23.0.3
     - https://github.com/Shopify/shopify_app/blob/v23.0.3/CHANGELOG.md#2303-june-24-2026
     - https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
     - https://github.com/Shopify/shopify_app/pull/2081
+    - https://advisories.gitlab.com/gem/shopify_app/CVE-2026-63414
     - https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
+    - https://github.com/advisories/GHSA-6j52-38f8-qhxr
 notes: |
-  - GHSA has "High" severity.
+  - cvss_v4 from GHSA URL.
   - date from CHANGELOG.md
-  - no CVE
+  - CVE from GHSA URL - it is reserved but not published.

lib/rad-ignores.sh

@@ -298,6 +298,15 @@ rm -f gems/crass/CVE-2026-61845.yml
 # 10/24/2026: "Disputed" @ https://nvd.nist.gov/vuln/detail/cve-2018-18260
 rm -f gems/camaleon_cms/CVE-2018-18260.yml
 
+# 10/29/2026: Use GHSA prefix over CVE.
+rm -f gems/crass/CVE-2026-116695.yml
+
+# 10/30/2026: Used GHSA prefix over CVE.
+rm -f gems/shopify_app/CVE-2026-63414.yml \
+      gems/crass/CVE-2026-61846.yml \
+      gems/crass/CVE-2026-61847.yml \
+      gems/crass/CVE-2026-61848.yml
+
 # 9/4/2026: More duplicates and withdrawns
 # nokogiri  | https://github.com/advisories/GHSA-5jhf-fpp7-v2pv (duplicate)
 # nokogiri  | https://github.com/advisories/GHSA-xqqh-3w52-q8p7 (duplicate)