https://vulnerability.circl.lu/sightings/feed 2026-10-11T21:29:55.043522+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ebdc00ad-220a-4677-8c09-197e51e3acfe/export 2026-10-11T21:29:55.067486+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ebdc00ad-220a-4677-8c09-197e51e3acfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107399", "type": "seen", "source": "https://gist.github.com/alon710/2dbcf719cd5bc48c77a596fbdbc6410f", "content": "# CVE-2026-107399: CVE-2026-107399: Information Disclosure via HTML Meta-Refresh in Ruby Mechanize\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107399\n\n## Summary\nAn origin trust boundary failure in the Ruby mechanize library (prior to v2.14.1) allows unauthenticated remote web servers to harvest sensitive global request headers, such as Authorization Bearer tokens and cookies, by utilizing HTML-level meta-refresh redirection tags. Standard HTTP-level redirect boundaries were not applied to document-level redirects, creating a vector for cross-origin credential leakage during automated crawls.\n\n## TL;DR\nRuby Mechanize prior to version 2.14.1 fails to enforce origin trust boundaries when executing HTML meta-refreshes, allowing third-party hosts to exfiltrate globally configured request headers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network\n- **CVSS Score**: 6.8\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n- **Impact**: High Confidentiality Loss\n- **Affected Component**: Mechanize::HTTP::Agent\n\n## Affected Systems\n\n- Ruby systems running mechanize gem versions prior to 2.14.1\n- **mechanize**: < 2.14.1 (Fixed in: `2.14.1`)\n\n## Mitigation\n\n- Upgrade the Ruby mechanize gem to version 2.14.1 or higher.\n- Disable automatic meta-refresh tracking by setting follow_meta_refresh to false.\n- Avoid configuring sensitive credentials globally on the Mechanize agent object; use per-request headers instead.\n\n**Remediation Steps:**\n1. Inspect the Gemfile.lock file to determine the current version of the mechanize library.\n2. Update the Gemfile dependency statement to require mechanize version >= 2.14.1.\n3. Execute `bundle update mechanize` within the application environment to fetch the patch.\n4. Verify that any automated scripts that rely on request_headers do not process untrusted, user-supplied content without disabling follow_meta_refresh.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f)\n- [Mechanize Release v2.14.1](https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1)\n- [Core Fix Pull Request](https://github.com/sparklemotion/mechanize/pull/676)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107399) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T09:30:30.000000Z"} 2026-10-09T09:30:30+00:00