Mechanize Project Mechanize vulnerabilities

CVE-2021-32837 [HIGH] CWE-1333 CVE-2021-32837: mechanize, a library for automatically interacting with HTTP web servers, contains a regular express mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.

CVE-2021-21289 [HIGH] CWE-78 CVE-2021-21289: Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize fro Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possib

CVE-2022-31033 [HIGH] CWE-200 CVE-2022-31033: The Mechanize library is used for automating interaction with websites. Mechanize automatically stor The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or late

CVE-2026-107715 [MEDIUM] CWE-200 Mechanize sends credential headers to another host after an HTTP redirect Mechanize sends credential headers to another host after an HTTP redirect ## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credentials set through `Mechanize#request_headers=` leaked even when they were `Authorization`. ## Details Two defects, both in `lib/mechanize/http/agent.rb`. **1. `Mechanize#request_headers=` bypassed

CVE-2026-107399 [MEDIUM] CWE-200 Mechanize sends credential headers to another origin after a meta refresh Mechanize sends credential headers to another origin after a meta refresh ## Summary `mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_headers=` followed a refresh that pointed at another origin. ## Details `Mechanize::HTTP::Agent#response_follow_meta_refresh` fetched the refresh target with no notion of a crossed origin, so `@reque