CVE-2026-25500.yml

---
gem: rack
cve: 2026-25500
ghsa: whrj-4476-wvmp
url: https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
title: 'Stored XSS in Rack::Directory via javascript: filenames rendered into anchor
  href'
date: 2026-02-17
description: |-
  ## Summary

  `Rack::Directory` generates an HTML directory index where each file entry is rendered as a clickable link. If a file exists on disk whose basename begins with the `javascript:` scheme (e.g. `javascript:alert(1)`), the generated index includes an anchor whose `href` attribute is exactly `javascript:alert(1)`. Clicking this entry executes arbitrary JavaScript in the context of the hosting application.

  This results in a client-side XSS condition in directory listings generated by `Rack::Directory`.

  ## Details

  `Rack::Directory` renders directory entries using an HTML row template similar to:

  ```html
  <a href='%s'>%s</a>
  ```

  The `%s` placeholder is populated directly with the file’s basename. If the basename begins with `javascript:`, the resulting HTML contains an executable JavaScript URL:

  ```html
  <a href='javascript:alert(1)'>javascript:alert(1)</a>
  ```

  Because the value is inserted directly into the `href` attribute without scheme validation or normalization, browsers interpret it as a JavaScript URI. When a user clicks the link, the JavaScript executes in the origin of the Rack application.

  ## Impact

  If `Rack::Directory` is used to expose filesystem contents over HTTP, an attacker who can create or upload files within that directory may introduce a malicious filename beginning with `javascript:`.

  When a user visits the directory listing and clicks the entry, arbitrary JavaScript executes in the application's origin. Exploitation requires user interaction (clicking the malicious entry).

  ## Mitigation

  * Update to a patched version of Rack in which `Rack::Directory` prefixes generated anchors with a relative path indicator (e.g. `./filename`).
  * Avoid exposing user-controlled directories via `Rack::Directory`.
  * Apply a strict Content Security Policy (CSP) to reduce impact of potential client-side execution issues.
  * Where feasible, restrict or sanitize uploaded filenames to disallow dangerous URI scheme prefixes.
cvss_v3: 5.4
patched_versions:
  - "~> 2.2.22"
  - "~> 3.1.20"
  - ">= 3.2.5"
related:
  url:
    - https://github.com/rack/rack/security/advisories/GHSA-whrj-4476-wvmp
    - https://github.com/rack/rack/commit/f2f225f297b99fbee3d9f51255d41f601fc40aff
    - https://github.com/advisories/GHSA-whrj-4476-wvmp