Most recent entries from all

bdu:2026-07220

BREW-mailcatcher-CVE-2026-25500 — Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Affected: Homebrew: mailcatcher

## Summary

`Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.

This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.

## Details

`Rack::Directory` renders directory entries using an HTML row template similar to:

```html <a href='%s'>%s</a> ```

The `%s` placeholder is populated directly with the file’s basename. If the basename begins with `javascript:`, the resulting HTML contains an executable JavaScript URL:

```html <a href='javascript:alert(1)'>javascript:alert(1)</a> ```

Because the value is inserted directly into the `href` attribute without scheme validation or normalization, browsers interpret it as a JavaScript URI. When a user clicks the link, the JavaScript executes in the origin of the Rack application.

## Impact

If `Rack::Directory` is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with `javascript:`.

When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction…

certfr-2026-avi-0316 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2026-avi-0316

Withdrawn: CLEANSTART-2026-GE08280 — Ruby JSON is a JSON implementation for Ruby

Withdrawn by the publisher.

Affected: CleanStart: logstash-fips

Multiple security vulnerabilities affect the logstash-fips package. Ruby JSON is a JSON implementation for Ruby. See references for individual vulnerability details.

EUVD-2026-268825

fkie_cve-2026-25500

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

GHSA-whrj-4476-wvmp — Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Affected: RubyGems: rack

## Summary

This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.

## Details

`Rack::Directory` renders directory entries using an HTML row template similar to:

```html <a href='%s'>%s</a> ```

The `%s` placeholder is populated directly with the file’s basename. If the basename begins with `javascript:`, the resulting HTML contains an executable JavaScript URL:

```html <a href='javascript:alert(1)'>javascript:alert(1)</a> ```

## Impact

If `Rack::Directory` is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with `javascript:`.

When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction…

openSUSE-SU-2026:10286-1 — ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media

ruby4.0-rubygem-rack-2.2-2.2.22-1.1 on GA media

UBUNTU-CVE-2026-25500

Affected: Ubuntu:Pro:14.04:LTS: ruby-rack, Ubuntu:Pro:16.04:LTS: ruby-rack, Ubuntu:Pro:18.04:LTS: ruby-rack, Ubuntu:Pro:20.04:LTS: ruby-rack, Ubuntu:Pro:22.04:LTS: ruby-rack, Ubuntu:24.04:LTS: ruby-rack, Ubuntu:25.10: ruby-rack, Ubuntu:26.04:LTS: ruby-rack

WID-SEC-W-2026-0881 — IBM License Metric Tool: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in IBM License Metric Tool ausnutzen, um Informationen offenzulegen, einen Cross Site Scripting Angriff durchzuführen oder einen Denial of Service zu verursachen.