CVE-2026-25500
Fixed in a distro release EPSS <1%CVSS 5.4
Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.
Products: Rack
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | rack | 2.2.22 |
| RubyGems | rack | 3.1.20 |
| RubyGems | rack | 3.2.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | gitlab-exporter-18.6 | 18.6.6-r1 |
| Chainguard | gitlab-exporter-18.7 | 18.7.4-r1 |
| Chainguard | gitlab-exporter-18.8 | 18.8.4-r1 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r13 |
| Chainguard | gitlab-rails-ce-18.2 | no fix |
| Chainguard | gitlab-rails-ce-18.3 | no fix |
| Chainguard | gitlab-rails-ce-18.4 | no fix |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | 18.8.7-r0 |
| Chainguard | gitlab-rails-ce-18.9 | 18.9.3-r0 |
| Chainguard | gitlab-rails-ce-fips-18.1 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.2 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.3 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.4 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | 18.8.7-r0 |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.3-r0 |
| Chainguard | kube-fluentd-operator | 1.18.2-r60 |
| Chainguard | logstash-8.17 | 8.17.10-r12 |
| Chainguard | logstash-8.17-iamguarded-compat | 8.17.10-r12 |
| Chainguard | logstash-8.17-with-output-opensearch | 8.17.10-r12 |
| Chainguard | logstash-8.18 | no fix |
| Chainguard | logstash-8.18-iamguarded-compat | no fix |
| Chainguard | logstash-8.18-with-output-opensearch | no fix |
| Chainguard | logstash-8.19 | 8.19.11-r1 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.11-r1 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.11-r1 |
| Chainguard | logstash-9.0 | 9.0.8-r11 |
| Chainguard | logstash-9.0-iamguarded-compat | 9.0.8-r11 |
| Chainguard | logstash-9.0-with-output-opensearch | 9.0.8-r11 |
| Chainguard | logstash-9.1 | 9.1.10-r1 |
| Chainguard | logstash-9.1-bitnami-compat | 9.1.10-r1 |
| Chainguard | logstash-9.1-iamguarded-compat | 9.1.10-r1 |
| Chainguard | logstash-9.1-with-output-opensearch | 9.1.10-r1 |
| Chainguard | logstash-9.2 | 9.2.5-r1 |
| Chainguard | logstash-9.2-iamguarded-compat | 9.2.5-r1 |
| Chainguard | logstash-9.2-with-output-opensearch | 9.2.5-r1 |
| Chainguard | logstash-9.3 | 9.3.1-r1 |
| Chainguard | logstash-9.3-iamguarded-compat | 9.3.1-r1 |
| Chainguard | logstash-9.3-with-output-opensearch | 9.3.1-r1 |
| Chainguard | ruby3.2-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.2-rails-7.1 | 7.1.6-r2 |
| Chainguard | ruby3.2-rails-7.2 | 7.2.3-r2 |
| Chainguard | ruby3.2-rails-8.0 | 8.0.4-r2 |
| Chainguard | ruby3.2-rails-8.1 | 8.1.2-r1 |
| Chainguard | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.3-rails-7.1 | 7.1.6-r2 |
| Chainguard | ruby3.3-rails-7.2 | 7.2.3-r2 |
| Chainguard | ruby3.3-rails-8.0 | 8.0.4-r2 |
| Chainguard | ruby3.3-rails-8.1 | 8.1.2-r2 |
| Chainguard | ruby3.4-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby3.4-rails-7.1 | 7.1.6-r2 |
| Chainguard | ruby3.4-rails-7.2 | 7.2.3-r2 |
| Chainguard | ruby3.4-rails-8.0 | 8.0.4-r2 |
| Chainguard | ruby3.4-rails-8.1 | 8.1.2-r1 |
| Chainguard | ruby4.0-rack-2.2 | 2.2.22-r0 |
| Chainguard | ruby4.0-rails-7.1 | 7.1.6-r1 |
| Chainguard | ruby4.0-rails-7.2 | 7.2.3-r2 |
| Chainguard | ruby4.0-rails-8.0 | 8.0.4-r1 |
| Chainguard | ruby4.0-rails-8.1 | 8.1.2-r1 |
| Debian 11 | ruby-rack | 2.1.4-3+deb11u5 |
| Debian 12 | ruby-rack | 2.2.22-0+deb12u1 |
| Debian 13 | ruby-rack | 3.1.20-0+deb13u1 |
| Debian 14 | ruby-rack | 3.2.5-1 |
| Ubuntu 24.04 LTS | ruby-rack | 2.2.7-1ubuntu0.6 |
| Ubuntu 25.10 | ruby-rack | 3.1.16-0.1ubuntu0.2 |
| Ubuntu 26.04 LTS | ruby-rack | 3.2.4-1ubuntu1 |
| Ubuntu 26.10 | ruby-rack | 3.2.4-1ubuntu1 |
| Ubuntu Pro 14.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 16.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 18.04 LTS | ruby-rack | no fix |
| Ubuntu Pro 20.04 LTS | ruby-rack | 2.0.7-2ubuntu0.1+esm9 |
| Ubuntu Pro 22.04 LTS | ruby-rack | 2.1.4-5ubuntu1.2+esm2 |
| Wolfi | kube-fluentd-operator | 1.18.2-r60 |
| Wolfi | logstash-9.1 | 9.1.10-r1 |
| Wolfi | logstash-9.1-bitnami-compat | 9.1.10-r1 |
| Wolfi | logstash-9.1-iamguarded-compat | 9.1.10-r1 |
| Wolfi | logstash-9.1-with-output-opensearch | 9.1.10-r1 |
| Wolfi | logstash-9.2 | 9.2.5-r1 |
| Wolfi | logstash-9.2-iamguarded-compat | 9.2.5-r1 |
| Wolfi | logstash-9.2-with-output-opensearch | 9.2.5-r1 |
| Wolfi | logstash-9.3 | 9.3.1-r1 |
| Wolfi | logstash-9.3-iamguarded-compat | 9.3.1-r1 |
| Wolfi | logstash-9.3-with-output-opensearch | 9.3.1-r1 |
| Wolfi | ruby3.2-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.2-rails-8.0 | 8.0.4-r2 |
| Wolfi | ruby3.2-rails-8.1 | 8.1.2-r1 |
| Wolfi | ruby3.3-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.3-rails-8.0 | 8.0.4-r2 |
| Wolfi | ruby3.3-rails-8.1 | 8.1.2-r2 |
| Wolfi | ruby3.4-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby3.4-rails-8.0 | 8.0.4-r2 |
| Wolfi | ruby3.4-rails-8.1 | 8.1.2-r1 |
| Wolfi | ruby4.0-rack-2.2 | 2.2.22-r0 |
| Wolfi | ruby4.0-rails-8.1 | 8.1.2-r1 |
| openSUSE Tumbleweed | rubygem-rack-2.2 | 2.2.22-1.1 |