-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| rack | rubygems | < 2.2.12 | 2.2.12 |
| rack | rubygems | >= 3.0, < 3.0.13 | 3.0.13 |
| rack | rubygems | >= 3.1, < 3.1.11 | 3.1.11 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the logging of unescaped user-controlled input (the X-Sendfile-Type header) in Rack::Sendfile. The commit diff shows the fix replaced direct string interpolation (#{type}) with #{type.inspect}, which sanitizes the output. The affected code path occurs when handling unknown X-Sendfile variations, making the call method in lib/rack/sendfile.rb the vulnerable function. The CWEs (CRLF Injection and Log Injection) directly align with this code pattern.
Ongoing coverage of React2Shell