CVE-2025-25184: Ruby Rack Cve 2025 25184 Crlf Allowlist
Detected the flawed sanitization regex `/[^[:print:]\n]/`. This pattern replaces non-printable characters but explicitly skips newline characters (`\n`), allowing them to bypass the filter. In contexts like logging (e.g., `Rack::CommonLogger`), this leads to Log Injection/CRLF injection (CWE-117) as unescaped newlines can be manipulated by attackers to embed
Rubygreprules fetch cve-2025-25184-ruby-rack-cve-2025-25184-crlf-allowlist --engine opengrepDescription
Detected the flawed sanitization regex `/[^[:print:]\n]/`. This pattern replaces non-printable characters but explicitly skips newline characters (`\n`), allowing them to bypass the filter. In contexts like logging (e.g., `Rack::CommonLogger`), this leads to Log Injection/CRLF injection (CWE-117) as unescaped newlines can be manipulated by attackers to embed
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.