-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | >= 7.0.0, < 7.0.4.1 | 7.0.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the URL host validation check implemented in Rails 7.0's redirect_to protection. The patch name ('Fix-sec-issue-with-_url_host_allowed.patch') and release notes explicitly reference fixes to _url_host_allowed? as the root cause. This method was responsible for validating redirect targets but contained bypassable checks, making it the clear vulnerable function. The vulnerability manifests when this method fails to properly validate crafted URLs passed to redirect_to with user input.
Ongoing coverage of React2Shell