https://vulnerability.circl.lu/sightings/feed 2026-10-11T17:11:22.846303+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/bc5fb79a-982b-4b60-b7b4-7eabc8560658/export 2026-10-11T17:11:22.865671+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bc5fb79a-982b-4b60-b7b4-7eabc8560658", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107715", "type": "seen", "source": "https://gist.github.com/alon710/d798ff57e2b794b2a7454047e0b97580", "content": "# CVE-2026-107715: CVE-2026-107715: Information Disclosure and Credential Leakage in Ruby Mechanize via Cross-Origin Redirections\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-107715\n\n## Summary\nRuby Mechanize prior to version 2.14.1 contains an information disclosure vulnerability. When executing cross-origin HTTP redirects, global headers configured on the Mechanize agent (such as Authorization or Session Cookies) are dynamically re-applied to the subsequent request, bypassing the internal header-stripping logic. An attacker who controls a redirection endpoint can capture sensitive bearer tokens or cookies.\n\n## TL;DR\nMechanize prior to 2.14.1 fails to prevent caller-supplied global credentials from being transmitted to untrusted hosts during cross-origin HTTP redirections, exposing sensitive credentials to third parties.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-200\n- **Attack Vector**: Network (High Complexity)\n- **CVSS v3.1**: 6.8 (Medium)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Remediation Status**: Patched in v2.14.1\n\n## Affected Systems\n\n- Ruby Mechanize library prior to 2.14.1\n- **mechanize**: < 2.14.1 (Fixed in: `2.14.1`)\n\n## Mitigation\n\n- Upgrade Mechanize to version 2.14.1 or higher.\n- Avoid using global `Mechanize#request_headers=` to assign sensitive values like API tokens.\n- Disable automatic redirects by setting `agent.redirect_ok = false` and handling HTTP redirections manually with host domain checks.\n\n**Remediation Steps:**\n1. Open the Gemfile of your Ruby application.\n2. Locate the `mechanize` gem dependency line.\n3. Update the dependency constraint to `gem 'mechanize', '>= 2.14.1'`.\n4. Run `bundle update mechanize` to download and apply the patch.\n5. Verify the installation using `bundle info mechanize` to confirm it is running version 2.14.1 or greater.\n\n## References\n\n- [GHSA-2mwr-xjcg-37j7: Mechanize Credential Leakage on HTTP Redirect](https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7)\n- [Mechanize PR 676: Strip credentials on redirect properly](https://github.com/sparklemotion/mechanize/pull/676)\n- [Mechanize Release Tag v2.14.1](https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-107715) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-09T10:30:30.000000Z"} 2026-10-09T10:30:30+00:00