From aa35cc38575b6322bd1eb47ddb761cf9b344bb3d Mon Sep 17 00:00:00 2001
From: Andrew Kane <andrew@ankane.org>
Date: Tue, 10 Nov 2026 19:34:01 -0800
Subject: [PATCH] Add GHSA-586r-mm5q-xhg2 for lockbox

---
 gems/lockbox/GHSA-586r-mm5q-xhg2.yml | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)
 create mode 100644 gems/lockbox/GHSA-586r-mm5q-xhg2.yml

diff --git a/gems/lockbox/GHSA-586r-mm5q-xhg2.yml b/gems/lockbox/GHSA-586r-mm5q-xhg2.yml
new file mode 100644
index 0000000000..f5acf1a2c9
--- /dev/null
+++ b/gems/lockbox/GHSA-586r-mm5q-xhg2.yml
@@ -0,0 +1,23 @@
+---
+gem: lockbox
+ghsa: 586r-mm5q-xhg2
+url: https://github.com/ankane/lockbox/security/advisories/GHSA-586r-mm5q-xhg2
+title: Insecure hybrid cryptography
+date: 2026-11-10
+description: |
+  With hybrid cryptography, an attacker who obtains the encryption key can use
+  it to decrypt data (acting as symmetric encryption rather than asymmetric).
+patched_versions:
+  - ">= 2.3.0"
+unaffected_versions:
+  - "< 0.1.1"
+cvss_v3: 4.9
+related:
+  url:
+    - https://rubygems.org/gems/lockbox/versions/2.3.0
+    - https://github.com/ankane/lockbox/blob/master/CHANGELOG.md#230-2026-11-10
+    - https://github.com/ankane/lockbox/compare/v2.2.0...v2.3.0
+    - https://github.com/ankane/lockbox/security/advisories/GHSA-586r-mm5q-xhg2
+notes: |
+  - cvss_v3 from project GHSA
+  - No CVE