GHSA-hxx2-7vcw-mqr3: sinatra fixed in 4.1.0

GHSA-hxx2-7vcw-mqr3 PUBLISHED CVSS 5.400000095367432 MEDIUM

Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

Record from GitHub Advisory Database · Published November 1, 2024

sinatra is fixed in 4.1.0 (RubyGems)

Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
sinatra	RubyGems	4.1.0
gitlab-cng-18.11	Chainguard	18.11.5-r2
ruby3.3-sinatra	Chainguard	4.1.0-r0
ruby3.2-sinatra	Wolfi	4.1.0-r0
logstash-jre-bcfips	Chainguard	8.17.0-r0
gitlab-cng-19.0	Chainguard	19.0.0-r3
logstash-8	Chainguard	8.16.0-r2
gitlab-cng-18.9	Chainguard	18.9.5-r0
ruby3.2-sinatra	Chainguard	4.1.0-r0
ruby3.3-sinatra	Wolfi	4.1.0-r0
logstash-8	Wolfi	8.16.0-r2

Risk scores

CVSS 3.1

5.400000095367432

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected products

Vendor	Product	Versions
chainguard	gitlab-cng-18.11	0
RubyGems	sinatra	0
chainguard	ruby3.3-sinatra	0
wolfi	ruby3.2-sinatra	0
RubyGems	sinatra
chainguard	logstash-jre-bcfips	0
chainguard	gitlab-cng-19.0	0
chainguard	logstash-8	0
chainguard	gitlab-cng-18.9	0
chainguard	ruby3.2-sinatra	0
wolfi	ruby3.3-sinatra	0
wolfi	logstash-8	0

Timeline

Nov 1, 2024 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-hxx2-7vcw-mqr3
vulnetix vdb fixes GHSA-hxx2-7vcw-mqr3

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-hxx2-7vcw-mqr3/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →