# Recent vulnerabilities in Jekyll and Jekyll dependencies **URL:** \ **Category:** Help\ **Created:** [October 2, 2018, 8:19pm UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219 "2018-10-02T20:19:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![chrisdaaz](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/chrisdaaz/32/830_2.png) [@chrisdaaz](https://talk.jekyllrb.com/u/chrisdaaz)\ **Post date:** [October 2, 2018, 8:19pm UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/1 "2018-10-02T20:19:13Z")
I’m curious about recent vulnerabilities in `jekyll`, `rubyzip`, and `ffi`. I built a site with Jekyll that I’m not planning on updating any time soon, and it’s on a production CDN right now. Do I have to address these vulnerabilities? ![image](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/7/7f7fcb6efa8b21de80fe6b597f5130ce9514cf63.png) My gut tells me “no” since it’s a static site… but my code it on Github so maybe my GitHub account can be attacked? I’m not really a developer so I’m confused about what these alerts mean. I thought a primary advantage of static vs dynamic sites was that static sites don’t require security patches or software packages. ---
**Author:** ![chrisdaaz](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/chrisdaaz/32/830_2.png) [@chrisdaaz](https://talk.jekyllrb.com/u/chrisdaaz)\ **Post date:** [October 2, 2018, 8:36pm UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/2 "2018-10-02T20:36:24Z")
I’m wondering addressing these vulnerabilities would only be necessary if I’m running Jekyll on a public server as part of a larger app or publishing workflow? ---
**Author:** ![Frank](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/frank/32/26_2.png) [@Frank](https://talk.jekyllrb.com/u/Frank)\ **Post date:** [October 5, 2018, 8:10am UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/3 "2018-10-05T08:10:12Z")
The “include symlink” was a major concern for GitHub as one could access for instance `/etc/password` on your server through that vulnerability. we had to [report the issue](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17567) to let know all companies (CloudCannon, SiteLeaf, Netlify, and al) and people hosting jekyll websites about this security issue. You could host your repo on GitHub and host your Jekyll’s site elsewhere, so GitHub has to warn you. If you run Jekyll on GitHub Pages, you are fine as they patched and bump gems to latest versions. GitHub Pages ignores your `Gemfile` during build anyway. If you run Jekyll on your server you should be concerned though. ---
**Author:** ![chrisdaaz](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/chrisdaaz/32/830_2.png) [@chrisdaaz](https://talk.jekyllrb.com/u/chrisdaaz)\ **Post date:** [October 5, 2018, 5:58pm UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/4 "2018-10-05T17:58:17Z")
OK, thanks for the context. ---
**Author:** ![stubrady78](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/stubrady78/32/1447_2.png) [@stubrady78](https://talk.jekyllrb.com/u/stubrady78)\ **Post date:** [January 6, 2019, 3:18am UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/5 "2019-01-06T03:18:59Z")
I’m in a similar position to the OP - non-developer hosting a simple static site on Github - and I got the following security warnings from Github this morning: ![image](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/6/6b2d09cac9da36163636c8c0ea0c5e4b569ecde7.png) ![image](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/f/fdaddd3e64e49c314480b45cbefc3d1d0ba61df6.png) I’m pretty sure I don’t have to do anything but for peace of mind can you confirm this? Regards, Stuart ---
**Author:** ![ashmaroli](https://avatars.discourse-cdn.com/v4/letter/a/df705f/32.png) [@ashmaroli](https://talk.jekyllrb.com/u/ashmaroli)\ **Post date:** [January 6, 2019, 9:33am UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/6 "2019-01-06T09:33:34Z")
Simply follow the instructions. Run `bundle update` to update your gemset for the project ---
**Author:** ![Frank](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/frank/32/26_2.png) [@Frank](https://talk.jekyllrb.com/u/Frank)\ **Post date:** [January 6, 2019, 2:39pm UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/7 "2019-01-06T14:39:25Z")
> [@stubrady78](#): > > I’m pretty sure I don’t have to do anything but for peace of mind can you confirm this? As there’s no breaking change, only bug fixes in v3.8.5, it looks like you can safely update your gems. If you don’t use symlinks, feel free to ignore the patched version, though `bundle` makes it easy to upgrade, ---
**Author:** ![stubrady78](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/stubrady78/32/1447_2.png) [@stubrady78](https://talk.jekyllrb.com/u/stubrady78)\ **Post date:** [January 7, 2019, 10:25am UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/8 "2019-01-07T10:25:50Z")
Thanks for the advice about my problem. I’ll update the gems this week. ---
**Author:** ![stubrady78](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/stubrady78/32/1447_2.png) [@stubrady78](https://talk.jekyllrb.com/u/stubrady78)\ **Post date:** [January 16, 2019, 9:05am UTC](https://talk.jekyllrb.com/t/recent-vulnerabilities-in-jekyll-and-jekyll-dependencies/2219/9 "2019-01-16T09:05:49Z")
I just wanted to say thanks again for the help as I’ve now updated my site on Github. I’ve actually been meaning to get back into Jekyll so, in a funny kind of way, this problem came at the right time:)