-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionmailer | rubygems | >= 3.0.0, < 6.1.7.9 | 6.1.7.9 |
| actionmailer | rubygems | >= 7.0.0, < 7.0.8.5 | 7.0.8.5 |
| actionmailer | rubygems | >= 7.1.0, < 7.1.4.1 | 7.1.4.1 |
| actionmailer | rubygems | >= 7.2.0, < 7.2.1.1 | 7.2.1.1 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly references the block_format helper in Action Mailer. Since Action Mailer uses Action View helpers, the logical location is TextHelper#block_format. The CWE-1333 indicates regex inefficiency, and Ruby 3.2's mitigations imply the root cause is regex-based. While exact code isn't shown, Rails' historical implementation of block_format uses paragraph splitting regex patterns that could become pathological. The combination of advisory details, CWE mapping, and Ruby version mitigations strongly supports this conclusion.
Ongoing coverage of React2Shell