Sparklemotion Mechanize vulnerabilities

CVE-2021-21289 [HIGH] CWE-78 CVE-2021-21289: Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize fro Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possib

CVE-2022-31033 [HIGH] CWE-200 CVE-2022-31033: The Mechanize library is used for automating interaction with websites. Mechanize automatically stor The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or late

CVE-2026-107715 [MEDIUM] CWE-200 CVE-2026-107715: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize s The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP redirect. Mechanize#request_headers= is reapplied by Mechanize::HTTP::Agent#request_add_headers even after Mechanize::HTTP::Agent#response_redirect strips per-request headers,

CVE-2026-107399 [MEDIUM] CWE-200 CVE-2026-107399: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize a The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to

CVE-2026-107714 [MEDIUM] CWE-200 CVE-2026-107714: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize:: The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host matches without consistently comparing scheme and port. A same-host HTTPS-to-HTTP redirect can send Authorization and Cookie headers over cleartext, while a same-host redire