https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 15:53:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107399 <p>The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.</p> <p>The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107399 https://vulnerability.circl.lu/vuln/ghsa-c6rp-p8xm-4q9f <p><strong>Affected:</strong> RubyGems: mechanize</p> <p>## Summary</p> <p>`mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_headers=` followed a refresh that pointed at another origin.</p> <p>## Details</p> <p>`Mechanize::HTTP::Agent#response_follow_meta_refresh` fetched the refresh target with no notion of a crossed origin, so `@request_headers` were re-applied in full. An attacker who could place a `meta` refresh in a page the agent fetched — through stored content, an open redirect, or control of any page in the crawl — collected the same credentials as through an HTTP redirect, on a code path that had none of the redirect path&#39;s protections.</p> <p>The refresh fetch passes an empty per-request headers hash, so only headers set through `Mechanize#request_headers=` were exposed.</p> <p>This requires `Mechanize#follow_meta_refresh = true`. It is `false` by default, so an agent in its default configuration is not affected. Crawlers commonly enable it.</p> <p>## Impact</p> <p>An attacker who can place a `meta` refresh in any page the agent fetches captures bearer tokens and session cookies set through `request_headers=`. Disclosure only; no integrity or availability impact.</p> <p>## Patches</p> <p>Fixed in `mechanize` v2.14.1. A `meta` refresh that points at another origin is now subject to the same rule as an HTTP redirect: credentials and cookies are withheld from the request that follows it.</p> <p>## Workarounds</p> <p>Leave `Mechanize#follow_meta_refresh` at its default of `false`, or avoid `request_headers=` for credentials when it is…</p> <p><strong>Affected:</strong> RubyGems: mechanize</p> <p>## Summary</p> <p>`mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_headers=` followed a refresh that pointed at another origin.</p> <p>## Details</p> <p>`Mechanize::HTTP::Agent#response_follow_meta_refresh` fetched the refresh target with no notion of a crossed origin, so `@request_headers` were re-applied in full. An attacker who could place a `meta` refresh in a page the agent fetched — through stored content, an open redirect, or control of any page in the crawl — collected the same credentials as through an HTTP redirect, on a code path that had none of the redirect path&#39;s protections.</p> <p>The refresh fetch passes an empty per-request headers hash, so only headers set through `Mechanize#request_headers=` were exposed.</p> <p>This requires `Mechanize#follow_meta_refresh = true`. It is `false` by default, so an agent in its default configuration is not affected. Crawlers commonly enable it.</p> <p>## Impact</p> <p>An attacker who can place a `meta` refresh in any page the agent fetches captures bearer tokens and session cookies set through `request_headers=`. Disclosure only; no integrity or availability impact.</p> <p>## Patches</p> <p>Fixed in `mechanize` v2.14.1. A `meta` refresh that points at another origin is now subject to the same rule as an HTTP redirect: credentials and cookies are withheld from the request that follows it.</p> <p>## Workarounds</p> <p>Leave `Mechanize#follow_meta_refresh` at its default of `false`, or avoid `request_headers=` for credentials when it is…</p> https://vulnerability.circl.lu/vuln/ghsa-c6rp-p8xm-4q9f