{"id":"CVE-2026-107399","title":"The Mechanize library is used for automating interaction with websites","summary":"The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A p…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","cwe":["CWE-200","CWE-522","CWE-201"],"vendor":"mechanize","product":"mechanize","affected":["mechanize < 2.14.1"],"patched":["mechanize 2.14.1"],"published":"2026-10-08","updated":"2026-10-14","sourceUpdated":"2026-10-14T02:16:57.060","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107399","references":[{"url":"https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f","label":"security-advisories@github.com"},{"url":"https://github.com/sparklemotion/mechanize/commit/84c74df87d15f5d119df268ba6aa79bc1e16a2c3","label":"security-advisories@github.com"},{"url":"https://github.com/sparklemotion/mechanize/pull/676","label":"security-advisories@github.com"},{"url":"https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1","label":"security-advisories@github.com"},{"url":"https://github.com/sparklemotion/mechanize/security/advisories/GHSA-c6rp-p8xm-4q9f","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-c6rp-p8xm-4q9f"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107399.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-107399"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548278"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107399"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107399"}],"tags":["nvd","ghsa","rubygems","cve.org","csaf","vex","red-hat"],"epss":0.00362,"epssPercentile":0.29907,"aliases":["GHSA-c6rp-p8xm-4q9f"],"ecosystem":"rubygems","ingestedAt":"2026-10-08T22:11:53.871Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-14T01:21:27.011574Z"},"scores":{"nvd":6.8,"vendor":5.9},"slug":"CVE-2026-107399","body":"## Overview\n\nThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-107399)\n\nAffected packages:\n\n- `mechanize < 2.14.1`\n\nPatched in:\n\n- `mechanize 2.14.1`\n\nSource: https://github.com/advisories/GHSA-c6rp-p8xm-4q9f\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat 3scale API Management Platform 2 · no fix planned: Red Hat 3scale API Management Platform 2 · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107399.json)","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}