Vulnerabilities

TI-2025-38270 CVE-2025-61921 · GHSA-mr3q-g2mv-mr4q

Sinatra has ReDoS vulnerability in ETag header value generation

LOW 20

Sinatra is a domain-specific language for creating web applications in Ruby.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00495 Published 2025-10-10 Partial fix · 4.2.0 CWE-1333

TI-2022-22408 CVE-2022-45442 · GHSA-2x8x-jmrp-phxw

HIGH 73

Sinatra is a domain-specific language for creating web applications in Ruby.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00694 Published 2022-11-28 Partial fix · 3.0.4, 2.2.3 CWE-494

TI-2022-12310 CVE-2022-29970 · GHSA-qp49-3pvw-x4m5

LOW 37

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02137 Published 2022-05-02 Partial fix · 2.2.0 CWE-22

TI-2018-08315 CVE-2018-11627 · GHSA-mq35-wqvf-r23c

LOW 31

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02159 Published 2018-05-31 Fixed in 2.0.2 CWE-79

TI-2018-05228 CVE-2018-7212 · GHSA-h29f-7f56-j8wh

LOW 28

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01838 Published 2018-02-18 Fixed in 2.0.1 CWE-22