CVE-2025-61594

Published: Dic 30, 2025 Last Modified: Apr 16, 2026
ExploitDB:
Other exploit source:
Google Dorks:
LOW 2,1
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none

Description

AI Translation Available

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials. This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0002
Percentile
0,0th
Updated

EPSS Score Trend (Last 91 Days)

200

Exposure of Sensitive Information to an Unauthorized Actor

Draft
Abstraction: Class Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Application Data
Applicable Platforms
Technologies: Mobile, Not Technology-Specific, Web Based
Likelihood of Exploit: High
View CWE Details
212

Improper Removal of Sensitive Information Before Storage or Transfer

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Files Or Directories Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
From 0.13.0 (inclusive)
To 0.13.3 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
To 0.12.5 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Uri by Ruby-Lang

Product Information
Vendor Ruby-Lang
Product Uri
Version Range Affected
From 1.0.0 (inclusive)
To 1.0.4 (exclusive)
cpe:2.3:a:ruby-lang:uri:*:*:*:*:*:ruby:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://github.com/advisories/GHSA-22h5-pq3x-2gf2
https://github.com/advisories/GHSA-22h5-pq3x-2gf2
https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3…
https://github.com/ruby/uri/security/advisories/GHSA-j4pr-3wm6-xx2r
https://hackerone.com/reports/2957667
https://hackerone.com/reports/2957667
https://www.ruby-lang.org/en/news/2025/02/26/security-advis…
https://www.ruby-lang.org/en/news/2025/02/26/security-advisories