5.4

CVE-2026-25500: rack Cross-site Scripting

CVSS: 5.4v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-25500DEBIAN-CVE-2026-25500CGA-35jr-xcrg-pwp8
Published 18-02-2026Last modified 18-02-2026
Open JSON

Vulnerability summary

CVE-2026-25500 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in rack. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.1% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
32/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.32%
0%100%
Low · +0.08 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
DLA-4505-1DSA-6180-1MGASA-2026-0075OPENSUSE-SU-2026:10286-1CGA-C5JR-5288-FHR3USN-8066-1

Timeline

  1. 18-02-2026
    PublishedVulnerability first disclosed.
  2. 18-02-2026
    Last modifiedVulnerability information updated.

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

+0.08 pp

From 0.23% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Rack

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard64 products
  • gitlab-exporter-18.6< 18.6.6-r1
  • gitlab-exporter-18.7< 18.7.4-r1
  • gitlab-exporter-18.8< 18.8.4-r1
  • gitlab-rails-ce-18.1< 18.1.6-r13
  • gitlab-rails-ce-18.2All versions (No fix recorded)
Wolfi12 products
  • kube-fluentd-operator< 1.18.2-r60
  • logstash-9.3< 9.3.1-r1
  • logstash-9.3-iamguarded-compat< 9.3.1-r1
  • logstash-9.3-with-output-opensearch< 9.3.1-r1
  • ruby3.2-rack-2.2< 2.2.22-r0
Debian1 product
  • ruby-rack< 2.2.22-0+deb12u1 | < 3.1.20-0+deb13u1 | < 3.2.5-1
Rack1 product
  • rack≥ 3.0.0.beta1, < 3.1.20 | < 2.2.22 | ≥ 3.0.0, < 3.1.20 | ≥ 3.2.0, < 3.2.5
RubyGems1 product
  • rack< 2.2.22 | ≥ 3.0.0.beta1, < 3.1.20 | ≥ 3.2.0, < 3.2.5
Ubuntu1 product
  • ruby-rackAll versions (No fix recorded) | < 2.0.7-2ubuntu0.1+esm9 | < 2.1.4-5ubuntu1.2+esm2 | < 2.2.7-1ubuntu0.6 | < 3.1.16-0.1ubuntu0.2 | < 3.2.4-1ubuntu1

6 vendors · 80 products

References

10 links