It looks like rexml is a dependency of the rbs gem which is forcing rexml to stay the same. Try updating the rbs gem instead. I'm not familiar with AWS security hub and it's CVE so I'm not sure about that