TI-2025-38270 CVE-2025-61921 · GHSA-mr3q-g2mv-mr4q
Sinatra has ReDoS vulnerability in ETag header value generation
Priority LOW 20
Sinatra is a domain-specific language for creating web applications in Ruby.
Vulnerabilities
6 records
TI-2022-22408 CVE-2022-45442 · GHSA-2x8x-jmrp-phxw
Sinatra vulnerable to Reflected File Download attack
Priority HIGH 73
Sinatra is a domain-specific language for creating web applications in Ruby.
TI-2022-12310 CVE-2022-29970 · GHSA-qp49-3pvw-x4m5
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Priority LOW 37
Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
TI-2018-08315 CVE-2018-11627 · GHSA-mq35-wqvf-r23c
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
Priority LOW 31
Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.
TI-2018-15772 CVE-2018-1000119 · GHSA-688c-3x49-6rqj
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack…
Priority LOW 31
Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed.
TI-2018-05228 CVE-2018-7212 · GHSA-h29f-7f56-j8wh
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in…
Priority LOW 28
An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows.