Two new advisories; Added 1 line to another (#1170)

Author: jasnow

gems/action_text-trix/GHSA-qmpg-8xg6-ph5q.yml

@@ -35,4 +35,5 @@ related:
     - https://github.com/basecamp/trix/releases/tag/v2.1.17
     - https://github.com/basecamp/trix/pull/1282
     - https://github.com/basecamp/trix/commit/53197ab5a142e6b0b76127cb790726b274eaf1bc
+    - https://hackerone.com/reports/3581911
     - https://github.com/advisories/GHSA-qmpg-8xg6-ph5q

gems/selenium-webdriver/CVE-2023-5590.yml

@@ -0,0 +1,28 @@
+---
+gem: selenium-webdriver
+cve: 2023-5590
+ghsa: 4phc-fq33-39gx
+url: https://nvd.nist.gov/vuln/detail/CVE-2023-5590
+title: NULL Pointer Dereference in seleniumhq/selenium
+date: 2023-10-23
+description: |
+  This is a null pointer dereference that causes the IE driver to
+  crash when selenium gets the cookies from an attacker controlled
+  page. At a high level, the bug is caused by an insufficient check
+  on data returned from Edge (Internet Explorer mode).
+cvss_v3: 7.5
+patched_versions:
+  - ">= 4.14.0"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-5590
+    - https://rubygems.org/gems/selenium-webdriver/versions/4.14.0
+    - https://github.com/SeleniumHQ/selenium/releases/tag/selenium-4.14.0
+    - https://github.com/seleniumhq/selenium/commit/023a0d52f106321838ab1c0997e76693f4dcbdf6
+    - https://huntr.com/bounties/e268cd68-4f34-49bd-878b-82b96dcc0c99
+    - https://github.com/advisories/GHSA-4phc-fq33-39gx
+notes: |
+  - Found above commit string in 4.14 release list using "null" pattern.
+  - cvss_v3 comes from GHSA.
+  - date comes from release URL.
+  - GHSA is unreviewed.

gems/shopify_app/GHSA-6j52-38f8-qhxr.yml

@@ -0,0 +1,49 @@
+---
+gem: shopify_app
+ghsa: 6j52-38f8-qhxr
+url: https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
+title: Token exchange shop context confusion may allow cross-shop
+  authorization bypass in affected apps
+date: 2026-06-24
+description: |
+  ## Description
+
+  In token-exchange authenticated controllers, shopify_app exposes shop
+  context through helpers such as current_shopify_domain. Prior to the
+  fix, current_shopify_domain could resolve to the sanitized shop query
+  parameter instead of the shop identity derived from the verified
+  Shopify ID token or active Shopify session.
+
+  As a result, a request authenticated for one shop could include a
+  different shop query parameter, causing application code to treat
+  the requested shop as the current shop.
+
+  Applications that used current_shopify_domain, or the request shop
+  parameter, for authorization decisions, tenant lookup, stored
+  access-token selection, or shop-scoped data access may have been
+  vulnerable to cross-shop context confusion.
+
+  The patched version hardens token-exchange handling so that:
+
+  * `current_shopify_domain` resolves to the authenticated shop from
+    the verified token or session.
+  * `authenticated_shopify_domain` exposes the trusted authenticated shop.
+  * `requested_shopify_domain` exposes the sanitized requested shop
+    parameter for bootstrap or routing use cases only.
+  * Token-exchange requests are rejected with `401 Unauthorized` when
+    the requested shop does not match the authenticated shop.
+unaffected_versions:
+  - "< 22.1.0"
+patched_versions:
+  - ">= 23.0.3"
+related:
+  url:
+    - https://rubygems.org/gems/shopify_app/versions/23.0.3
+    - https://github.com/Shopify/shopify_app/blob/v23.0.3/CHANGELOG.md#2303-june-24-2026
+    - https://github.com/Shopify/shopify_app/releases/tag/v23.0.3
+    - https://github.com/Shopify/shopify_app/pull/2081
+    - https://github.com/Shopify/shopify_app/security/advisories/GHSA-6j52-38f8-qhxr
+notes: |
+  - GHSA has "High" severity.
+  - date from CHANGELOG.md
+  - no CVE