From 36a90972f1c602127c58bdaa865c897c48e2686a Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Wed, 12 Aug 2026 14:10:25 -0400
Subject: [PATCH] One new sqlite3 advisory

---
 gems/sqlite3/GHSA-mwm8-39rw-8826.yml | 34 ++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 gems/sqlite3/GHSA-mwm8-39rw-8826.yml

diff --git a/gems/sqlite3/GHSA-mwm8-39rw-8826.yml b/gems/sqlite3/GHSA-mwm8-39rw-8826.yml
new file mode 100644
index 0000000000..3b801d388f
--- /dev/null
+++ b/gems/sqlite3/GHSA-mwm8-39rw-8826.yml
@@ -0,0 +1,34 @@
+---
+gem: sqlite3
+ghsa: mwm8-39rw-8826
+url: https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
+title: Use-After-Free in SQLite Aggregate Arguments in
+  Heap-Allocated Argument Array
+date: 2026-08-11
+description: |
+  ## Summary
+
+  Using Database#create_aggregate, #create_aggregate_handler, or
+  Database#define_aggregator to define an aggregate function that takes
+  two or more arguments, and then evaluating it over TEXT or BLOB column
+  values, can free the Ruby objects holding those arguments while a
+  later argument is still being converted, during ordinary garbage
+  collection. The aggregate's step method then receives an incorrect
+  object, or the process crashes with a segmentation fault.
+
+  ## Credits
+
+  Reported by Jeremy Daer (@jeremy).
+cvss_v4: 6.3
+unaffected_versions:
+  - "< 1.4.0"
+patched_versions:
+  - ">= 2.9.6"
+related:
+  url:
+    - https://rubygems.org/gems/sqlite3/versions/2.9.6
+    - https://github.com/sparklemotion/sqlite3-ruby/blob/main/CHANGELOG.md#296--2026-08-11
+    - https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
+notes: |
+  - cvss_v4 from repo GHSA URL.
+  - No CVE in repo GHSA URL.