VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Sep 25, 2017· Updated May 13, 2026

CVE-2017-14506

CVE-2017-14506

Description

geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
geminaboxRubyGems
< 0.13.60.13.6

Affected products

1

Patches

1
99aaae196c4f

Fix XSS & CSRF vulnerabilities - CVE-2017-14506

https://github.com/geminabox/geminaboxsonotsSep 18, 2017via ghsa
commit
3 files changed · +6 −2
  • lib/geminabox/server.rb+4 −0 modified
    @@ -297,6 +297,10 @@ def combined_gem_list
     end
 
     helpers do
+      def h(text)
+        Rack::Utils.escape_html(text)
+      end
+
       def spec_for(gem_name, version, platform = default_platform)
         filename = [gem_name, version]
         filename.push(platform) if platform != default_platform
  • views/gem.erb+1 −1 modified
    @@ -27,7 +27,7 @@
           <%= spec.description %>
           <br/>
           <span class="author">– <%= spec.authors.map do |author|
-            "<a href='#{spec.homepage}'>#{author}</a>"
+            "<a href='#{h(spec.homepage)}'>#{author}</a>"
           end.join(', ') %></span>
         <% end %>
         </p>
  • views/index.erb+1 −1 modified
    @@ -46,7 +46,7 @@
               <%= spec.description %>
               <br/>
               <span class="author">– <%= spec.authors.map do |author|
-                "<a href='#{spec.homepage}'>#{author}</a>"
+                "<a href='#{h(spec.homepage)}'>#{author}</a>"
               end.join(', ') %></span>
             <% end %>
           </p>

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.