CVE-2026-54659: Pagy I18n locale option is not validated before being used in a file path

July 28, 2026

Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file (<locale>.yml). An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params[:locale] — let that input influence which file Pagy attempted to load.

References

github.com/advisories/GHSA-2xmw-f8j8-wfxc
github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df
github.com/ddnexus/pagy/pull/908
github.com/ddnexus/pagy/releases/tag/43.5.6
github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc
nvd.nist.gov/vuln/detail/CVE-2026-54659

Code Behaviors & Features

Detect and mitigate CVE-2026-54659 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →