Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Résumé
Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the javascript: scheme (e.g. javascript:alert(1)), the generated index contains an anchor whose href is exactly javascript:alert(1). Clicking the entry executes JavaScript in the browser (demonstrated with alert(1)). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-25500 ruby-rack Corrigé dans: 2.1.4-3+deb11u5
- Ubuntu UBUNTU-CVE-2026-25500 ruby-rack
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com