CVE-2026-107399Medium· 6.8▾ SunlitThe Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A p…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mechanize < 2.14.1Patched in:
mechanize 2.14.1Source: https://github.com/advisories/GHSA-c6rp-p8xm-4q9f
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-107715Medium· 6.8The Mechanize library is used for automating interaction with websites
CVE-2026-107714Medium· 5.9The Mechanize library is used for automating interaction with websites
CVE-2019-13057Medium· 4.9An issue was discovered in the server in OpenLDAP before 2.4.48
CVE-2018-0495Medium· 4.7Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-…
CVE-2024-3656High· 8.1A flaw was found in Keycloak
CVE-2022-0987Low· 3.3A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files