Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Summary
Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
Original description
The description as published by the source.
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the javascript: scheme (e.g. javascript:alert(1)), the generated index contains an anchor whose href is exactly javascript:alert(1). Clicking the entry executes JavaScript in the browser (demonstrated with alert(1)). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-25500 ruby-rack Fixed in: 2.1.4-3+deb11u5
- Ubuntu UBUNTU-CVE-2026-25500 ruby-rack
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com