Read the docs
TI-2021-05764 Aliases CVE-2021-22903GHSA-5hq2-xf89-9jxq

Open redirect in https://github.com/rails/rails

Priority LOW 30CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.

Why it matters now

EPSS 0.0123 69th percentileScored 2026-11-07
Fix Fixed actionpack (RubyGems): 6.1.3.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—https://github.com/rails/railsFixed in 6.1.3.2—No fix listedCNA
—actionpack (RubyGems)6.1.0.rc2 to before 6.1.3.26.1.3.2Patch availableGHSA-5hq2-xf89-9jxq
  • https://github.com/rails/rails Vendor— Affected Fixed in 6.1.3.2 Fixed in — No fix listed CNA
  • actionpack (RubyGems) Vendor— Affected 6.1.0.rc2 to before 6.1.3.2 Fixed in 6.1.3.2 Patch available GHSA-5hq2-xf89-9jxq

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*6.1.1 to before 6.1.3.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:6.1.0:rc2:*:*:*:*:*:*6.1.0 rc2VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 6.1.1 to before 6.1.3.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:6.1.0:rc2:*:*:*:*:*:* Versions 6.1.0 rc2 Vulnerable ·Rails

Remediation

  • Fix · GHSA-5hq2-xf89-9jxq actionpack (RubyGems) Fixed in 6.1.3.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 2 products
  • CloudForms Management Engine 5
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-22903
  2. 2026-10-03 Alias added: GHSA-5hq2-xf89-9jxq

References

Patch 1

Advisory 2

Other 3

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences