« Volver al listado

CVE-2026-25500

Estado: AnalizadaMedia (5.4)—

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rack — Rack

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25500",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25500",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-18T19:42:04.480536Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "rack",
          "product": "rack",
          "versions": [
            {
              "status": "affected",
              "version": "< 2.2.22"
            },
            {
              "status": "affected",
              "version": ">= 3.0.0.beta1, < 3.1.20"
            },
            {
              "status": "affected",
              "version": ">= 3.2.0, < 3.2.5"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-18T20:18:36.110",
  "references": [
    {
      "url": "https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue."
    },
    {
      "lang": "es",
      "value": "Rack es una interfaz modular para servidores web Ruby. Antes de las versiones 2.2.22, 3.1.20 y 3.2.5, `Rack::Directory` generaba un índice de directorio HTML en el que cada entrada de archivo se representaba como un enlace en el que se podía hacer clic. Si existe un archivo en el disco cuyo nombre base comienza con el esquema `javascript:` (por ejemplo, `javascript:alert(1)`), el índice generado contiene un ancla cuyo `href` es exactamente `javascript:alert(1)`. Al hacer clic en la entrada, se ejecuta JavaScript en el navegador (demostrado con `alert(1)`). Las versiones 2.2.22, 3.1.20 y 3.2.5 corrigen el problema."
    }
  ],
  "lastModified": "2026-06-17T10:24:44.857",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58D73D7A-523C-4472-9322-87B5E7A785CA",
              "versionEndExcluding": "2.2.22"
            },
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76491EC1-2EA1-492E-97B2-2427EDFB0E07",
              "versionEndExcluding": "3.1.20",
              "versionStartIncluding": "3.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rack:rack:*:*:*:*:*:ruby:*:*",
              "vulnerable": true,
              "matchCriteriaId": "653A4AF6-055E-46F2-992E-C6624BBF8A25",
              "versionEndExcluding": "3.2.5",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}