CVE-2026-25500: Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href
(updated )
Rack::Directory generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the javascript: scheme (e.g. javascript:alert(1)), the generated index includes an anchor whose href attribute is exactly javascript:alert(1). Clicking this entry executes arbitrary JavaScript in the context of the hosting application.
This results in a client-side XSS condition in directory listings generated by Rack::Directory.
References
- github.com/advisories/GHSA-whrj-4476-wvmp
- github.com/rack/rack
- github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff
- github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2026-25500.yml
- nvd.nist.gov/vuln/detail/CVE-2026-25500
Code Behaviors & Features
Detect and mitigate CVE-2026-25500 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →