Skip to content

dotenv-rails-2.8.1.gem: 27 vulnerabilities (highest severity is: 7.5) #11

New issue
New issue
Open
Open
dotenv-rails-2.8.1.gem: 27 vulnerabilities (highest severity is: 7.5)#11
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend
@mend-for-github-com

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Feb 11, 2025
Vulnerable Library - dotenv-rails-2.8.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (dotenv-rails version) Remediation Possible**
CVE-2025-61919 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-61772 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-61771 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-61770 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-59830 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-46727 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-27610 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2025-27111 High 7.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2024-41128 High 7.5 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2025-25184 Medium 6.5 rack-2.2.7.gem Transitive N/A* ❌
CVE-2024-54133 Medium 6.1 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2024-53989 Medium 6.1 rails-html-sanitizer-1.5.0.gem Transitive N/A* ❌
CVE-2024-53988 Medium 6.1 rails-html-sanitizer-1.5.0.gem Transitive N/A* ❌
CVE-2024-53987 Medium 6.1 rails-html-sanitizer-1.5.0.gem Transitive N/A* ❌
CVE-2024-53986 Medium 6.1 rails-html-sanitizer-1.5.0.gem Transitive N/A* ❌
CVE-2024-53985 Medium 6.1 rails-html-sanitizer-1.5.0.gem Transitive N/A* ❌
CVE-2024-26143 Medium 6.1 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2025-61780 Medium 5.8 rack-2.2.7.gem Transitive N/A* ❌
CVE-2024-26141 Medium 5.8 rack-2.2.7.gem Transitive N/A* ❌
CVE-2024-28103 Medium 5.4 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2024-47887 Medium 5.3 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2024-26146 Medium 5.3 rack-2.2.7.gem Transitive N/A* ❌
CVE-2024-25126 Medium 5.3 rack-2.2.7.gem Transitive N/A* ❌
CVE-2023-38037 Medium 4.3 activesupport-7.0.4.3.gem Transitive N/A* ❌
CVE-2025-32441 Medium 4.2 rack-2.2.7.gem Transitive N/A* ❌
CVE-2023-28362 Medium 4.0 actionpack-7.0.4.3.gem Transitive N/A* ❌
CVE-2025-54314 Low 2.8 thor-1.2.1.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (22 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2025-61919

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, "Rack::Request#POST" reads the entire request body into memory for "Content-Type: application/x-www-form-urlencoded", calling "rack.input.read(nil)" without enforcing a length or cap. Large request bodies can therefore be buffered completely into process memory before parsing, leading to denial of service (DoS) through memory exhaustion. Users should upgrade to Rack version 2.2.20, 3.1.18, or 3.2.3, anu of which enforces form parameter limits using "query_parser.bytesize_limit", preventing unbounded reads of "application/x-www-form-urlencoded" bodies. Additionally, enforce strict maximum body size at the proxy or web server layer (e.g., Nginx "client_max_body_size", Apache "LimitRequestBody").

Publish Date: 2025-10-10

URL: CVE-2025-61919

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6xw4-3v39-52mm

Release Date: 2025-10-10

Fix Resolution: rack - 2.2.20

CVE-2025-61772

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, "Rack::Multipart::Parser" can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line ("CRLFCRLF"). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS). Attackers can send incomplete multipart headers to trigger high memory use, leading to process termination (OOM) or severe slowdown. The effect scales with request size limits and concurrency. All applications handling multipart uploads may be affected. Versions 2.2.19, 3.1.17, and 3.2.2 cap per-part header size (e.g., 64 KiB). As a workaround, restrict maximum request sizes at the proxy or web server layer (e.g., Nginx "client_max_body_size").

Publish Date: 2025-10-07

URL: CVE-2025-61772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v3.2.2

CVE-2025-61771

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, ``Rack::Multipart::Parser"stores non-file form fields (parts without a"filename") entirely in memory as Ruby "String"objects. A single large text field in a multipart/form-data request (hundreds of megabytes or more) can consume equivalent process memory, potentially leading to out-of-memory (OOM) conditions and denial of service (DoS). Attackers can send large non-file fields to trigger excessive memory usage. Impact scales with request size and concurrency, potentially leading to worker crashes or severe garbage-collection overhead. All Rack applications processing multipart form submissions are affected. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a reasonable size cap for non-file fields (e.g., 2 MiB). Workarounds include restricting maximum request body size at the web-server or proxy layer (e.g., Nginx"client_max_body_size`) and validating and rejecting unusually large form fields at the application level.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-10-07

URL: CVE-2025-61771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v3.1.17

CVE-2025-61770

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. In versions prior to 2.2.19, 3.1.17, and 3.2.2, "Rack::Multipart::Parser" buffers the entire multipart preamble (bytes before the first boundary) in memory without any size limit. A client can send a large preamble followed by a valid boundary, causing significant memory use and potential process termination due to out-of-memory (OOM) conditions. Remote attackers can trigger large transient memory spikes by including a long preamble in multipart/form-data requests. The impact scales with allowed request sizes and concurrency, potentially causing worker crashes or severe slowdown due to garbage collection. Versions 2.2.19, 3.1.17, and 3.2.2 enforce a preamble size limit (e.g., 16 KiB) or discard preamble data entirely. Workarounds include limiting total request body size at the proxy or web server level and monitoring memory and set per-process limits to prevent OOM conditions.

Publish Date: 2025-10-07

URL: CVE-2025-61770

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-10-07

Fix Resolution: https://github.com/rack/rack.git - v2.2.19

CVE-2025-59830

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to version 2.2.18, Rack::QueryParser enforces its params_limit only for parameters separated by &, while still splitting on both & and ;. As a result, attackers could use ; separators to bypass the parameter count limit and submit more parameters than intended. Applications or middleware that directly invoke Rack::QueryParser with its default configuration (no explicit delimiter) could be exposed to increased CPU and memory consumption. This can be abused as a limited denial-of-service vector. This issue has been patched in version 2.2.18.

Publish Date: 2025-09-25

URL: CVE-2025-59830

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-625h-95r8-8xpm

Release Date: 2025-09-25

Fix Resolution: https://github.com/rack/rack.git - v2.2.18

CVE-2025-46727

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.14, 3.0.16, and 3.1.14, "Rack::QueryParser" parses query strings and "application/x-www-form-urlencoded" bodies into Ruby data structures without imposing any limit on the number of parameters, allowing attackers to send requests with extremely large numbers of parameters. The vulnerability arises because "Rack::QueryParser" iterates over each "&"-separated key-value pair and adds it to a Hash without enforcing an upper bound on the total number of parameters. This allows an attacker to send a single request containing hundreds of thousands (or more) of parameters, which consumes excessive memory and CPU during parsing. An attacker can trigger denial of service by sending specifically crafted HTTP requests, which can cause memory exhaustion or pin CPU resources, stalling or crashing the Rack server. This results in full service disruption until the affected worker is restarted. Versions 2.2.14, 3.0.16, and 3.1.14 fix the issue. Some other mitigations are available. One may use middleware to enforce a maximum query string size or parameter count, or employ a reverse proxy (such as Nginx) to limit request sizes and reject oversized query strings or bodies. Limiting request body sizes and query string lengths at the web server or CDN level is an effective mitigation.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-05-07

URL: CVE-2025-46727

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-05-07

Fix Resolution: https://github.com/rack/rack.git - v2.2.14

CVE-2025-27610

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, "Rack::Static" can serve files under the specified "root:" even if "urls:" are provided, which may expose other files under the specified "root:" unexpectedly. The vulnerability occurs because "Rack::Static" does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory. By exploiting this vulnerability, an attacker can gain access to all files under the specified "root:" directory, provided they are able to determine then path of the file. Versions 2.2.13, 3.0.14, and 3.1.12 contain a patch for the issue. Other mitigations include removing usage of "Rack::Static", or ensuring that "root:" points at a directory path which only contains files which should be accessed publicly. It is likely that a CDN or similar static file server would also mitigate the issue.

Publish Date: 2025-03-10

URL: CVE-2025-27610

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-27111

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.

Publish Date: 2025-03-04

URL: CVE-2025-27111

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-03-04

Fix Resolution: v2.2.12,v3.0.13,v3.1.11

CVE-2024-41128

Vulnerable Library - actionpack-7.0.4.3.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-7.0.4.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-7.0.4.3.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • ❌ actionpack-7.0.4.3.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Publish Date: 2024-10-16

URL: CVE-2024-41128

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x76w-6vjr-8xgj

Release Date: 2024-10-16

Fix Resolution: actionpack - 6.1.7.9,7.0.8.5,7.1.4.1,7.2.1.1

CVE-2025-25184

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious content into logs. When a user provides the authorization credentials via Rack::Auth::Basic, if success, the username will be put in env['REMOTE_USER'] and later be used by Rack::CommonLogger for logging purposes. The issue occurs when a server intentionally or unintentionally allows a user creation with the username contain CRLF and white space characters, or the server just want to log every login attempts. If an attacker enters a username with CRLF character, the logger will log the malicious username with CRLF characters into the logfile. Attackers can break log formats or insert fraudulent entries, potentially obscuring real activity or injecting malicious data into log files. Versions 2.2.11, 3.0.12, and 3.1.10 contain a fix.

Publish Date: 2025-02-12

URL: CVE-2025-25184

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7g2v-jj9q-g3rg

Release Date: 2025-02-12

Fix Resolution: rack - 2.2.11,3.0.12,3.1.11

CVE-2024-54133

Vulnerable Library - actionpack-7.0.4.3.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-7.0.4.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-7.0.4.3.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • ❌ actionpack-7.0.4.3.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the "content_security_policy" helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.

Publish Date: 2024-12-10

URL: CVE-2024-54133

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vfm5-rmrh-j26v

Release Date: 2024-12-10

Fix Resolution: actionpack - 7.0.8.7,7.1.5.1,7.2.2.1,8.0.0.1

CVE-2024-53989

Vulnerable Library - rails-html-sanitizer-1.5.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.5.0.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rails-html-sanitizer-1.5.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02

URL: CVE-2024-53989

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxv5-gxqc-xx8g

Release Date: 2024-12-02

Fix Resolution: rails-html-sanitizer - 1.6.1

CVE-2024-53988

Vulnerable Library - rails-html-sanitizer-1.5.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.5.0.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rails-html-sanitizer-1.5.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02

URL: CVE-2024-53988

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2024-53987

Vulnerable Library - rails-html-sanitizer-1.5.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.5.0.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rails-html-sanitizer-1.5.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02

URL: CVE-2024-53987

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2x5m-9ch4-qgrr

Release Date: 2024-12-02

Fix Resolution: rails-html-sanitizer - 1.6.1

CVE-2024-53986

Vulnerable Library - rails-html-sanitizer-1.5.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.5.0.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rails-html-sanitizer-1.5.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02

URL: CVE-2024-53986

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-638j-pmjw-jq48

Release Date: 2024-12-02

Fix Resolution: rails-html-sanitizer - 1.6.1

CVE-2024-53985

Vulnerable Library - rails-html-sanitizer-1.5.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.5.0.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rails-html-sanitizer-1.5.0.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.

Publish Date: 2024-12-02

URL: CVE-2024-53985

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w8gc-x259-rc7x

Release Date: 2024-12-02

Fix Resolution: rails-html-sanitizer - 1.6.1

CVE-2024-26143

Vulnerable Library - actionpack-7.0.4.3.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-7.0.4.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-7.0.4.3.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • ❌ actionpack-7.0.4.3.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

Publish Date: 2024-02-27

URL: CVE-2024-26143

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2025-61780

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Prior to versions 2.2.20, 3.1.18, and 3.2.3, a possible information disclosure vulnerability existed in "Rack::Sendfile" when running behind a proxy that supports "x-sendfile" headers (such as Nginx). Specially crafted headers could cause "Rack::Sendfile" to miscommunicate with the proxy and trigger unintended internal requests, potentially bypassing proxy-level access restrictions. When "Rack::Sendfile" received untrusted "x-sendfile-type" or "x-accel-mapping" headers from a client, it would interpret them as proxy configuration directives. This could cause the middleware to send a "redirect" response to the proxy, prompting it to reissue a new internal request that was not subject to the proxy's access controls. An attacker could exploit this by setting a crafted "x-sendfile-type: x-accel-redirect" header, setting a crafted "x-accel-mapping" header, and requesting a path that qualifies for proxy-based acceleration. Attackers could bypass proxy-enforced restrictions and access internal endpoints intended to be protected (such as administrative pages). The vulnerability did not allow arbitrary file reads but could expose sensitive application routes. This issue only affected systems meeting all of the following conditions: The application used "Rack::Sendfile" with a proxy that supports "x-accel-redirect" (e.g., Nginx); the proxy did not always set or remove the "x-sendfile-type" and "x-accel-mapping" headers; and the application exposed an endpoint that returned a body responding to ".to_path". Users should upgrade to Rack versions 2.2.20, 3.1.18, or 3.2.3, which require explicit configuration to enable "x-accel-redirect". Alternatively, configure the proxy to always set or strip the header, or in Rails applications, disable sendfile completely.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-10-10

URL: CVE-2025-61780

CVSS 3 Score Details (5.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r657-rxjc-j557

Release Date: 2025-10-10

Fix Resolution: rack - 3.2.3

CVE-2024-26141

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Publish Date: 2024-02-28

URL: CVE-2024-26141

CVSS 3 Score Details (5.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

CVE-2024-28103

Vulnerable Library - actionpack-7.0.4.3.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-7.0.4.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-7.0.4.3.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • ❌ actionpack-7.0.4.3.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

Publish Date: 2024-06-04

URL: CVE-2024-28103

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fwhr-88qx-h9g7

Release Date: 2024-06-04

Fix Resolution: actionpack - 6.1.7.8,7.0.8.4,7.1.3.4

CVE-2024-47887

Vulnerable Library - actionpack-7.0.4.3.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-7.0.4.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-7.0.4.3.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • ❌ actionpack-7.0.4.3.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in Action Controller's HTTP Token authentication. For applications using HTTP Token authentication via authenticate_or_request_with_http_token or similar, a carefully crafted header may cause header parsing to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

Publish Date: 2024-10-16

URL: CVE-2024-47887

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vfg9-r3fq-jvx4

Release Date: 2024-10-16

Fix Resolution: actionpack - 6.1.7.9,7.0.8.5,7.1.4.1,7.2.1.1

CVE-2024-26146

Vulnerable Library - rack-2.2.7.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.7.gem

Dependency Hierarchy:

  • dotenv-rails-2.8.1.gem (Root Library)
    • railties-7.0.4.3.gem
      • actionpack-7.0.4.3.gem
        • ❌ rack-2.2.7.gem (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Publish Date: 2024-02-28

URL: CVE-2024-26146

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26146

Release Date: 2024-02-28

Fix Resolution: rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions