CVE-2026-25500: Rack's Stored XSS in Rack::Directory via javascript: filenames rendered into anchor href

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-02-18 · updated 2026-06-17
Weakness: CWE-79

Description

Rack is a modular Ruby web server interface. Prior to versions 2.2.22, 3.1.20, and 3.2.5, `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename starts with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index contains an anchor whose `href` is exactly `javascript:alert(1)`. Clicking the entry executes JavaScript in the browser (demonstrated with `alert(1)`). Versions 2.2.22, 3.1.20, and 3.2.5 fix the issue.

Affected products

rack: before 2.2.22; from 3.0.0 before 3.1.20; from 3.2.0 before 3.2.5 — fixed in 2.2.22, 3.1.20, 3.2.5
Rubygems Rack: before 2.2.22; from 3.0.0.beta1 before 3.1.20; from 3.2.0 before 3.2.5; 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.9.0, 0.9.1 (+166) — fixed in 2.2.22, 3.1.20, 3.2.5

How to fix

Upgrade to a fixed version: rack 2.2.22, 3.1.20, 3.2.5; Rubygems Rack 2.2.22, 3.1.20, 3.2.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-25500 or the next vulnerability affects your stack