CVE-2026-107399: sparklemotion mechanize

Vulnerability summary

CVE-2026-107399 is a medium (CVSS 6.8) vulnerability in sparklemotion mechanize. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.8% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 14-10-2026
   Last modifiedVulnerability information updated.

Description

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.