CVE-2026-25500 (Medium) detected in rack-3.1.16.gem

[mend-bolt-for-github]

CVE-2026-25500 - Medium Severity Vulnerability

Vulnerable Library - rack-3.1.16.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-3.1.16.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /vendor/cache/rack-3.1.16.gem

Dependency Hierarchy:

• manageiq-style-1.3.3.gem (Root Library)
  • rubocop-rails-2.32.0.gem
    • ❌ rack-3.1.16.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Summary "Rack::Directory" generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the "javascript:" scheme (e.g. "javascript:alert(1)"), the generated index includes an anchor whose "href" attribute is exactly "javascript:alert(1)". Clicking this entry executes arbitrary JavaScript in the context of the hosting application. This results in a client-side XSS condition in directory listings generated by "Rack::Directory". Details "Rack::Directory" renders directory entries using an HTML row template similar to: %s The "%s" placeholder is populated directly with the file’s basename. If the basename begins with "javascript:", the resulting HTML contains an executable JavaScript URL: javascript:alert(1) Because the value is inserted directly into the "href" attribute without scheme validation or normalization, browsers interpret it as a JavaScript URI. When a user clicks the link, the JavaScript executes in the origin of the Rack application. Impact If "Rack::Directory" is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with "javascript:". When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction (clicking the malicious entry). Mitigation * Update to a patched version of Rack in which "Rack::Directory" prefixes generated anchors with a relative path indicator (e.g. "./filename"). * Avoid exposing user-controlled directories via "Rack::Directory". * Apply a strict Content Security Policy (CSP) to reduce impact of potential client-side execution issues. * Where feasible, restrict or sanitize uploaded filenames to disallow dangerous URI scheme prefixes.

Publish Date: 2026-02-17

URL: CVE-2026-25500

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-whrj-4476-wvmp

Release Date: 2026-02-17

Fix Resolution: rack - 3.1.20,rack - 3.2.5,rack - 2.2.22

---

Step up your Open Source Security Game with Mend here