CVE-2017-14506

Name of the Vulnerable Software and Affected Versions geminabox versions prior to 0.13.6

Description The issue allows for Cross-site Scripting (XSS) attacks. This can be demonstrated by uploading a gem file with a crafted gem.homepage value in its .gemspec file.

Recommendations For versions prior to 0.13.6, update to version 0.13.6 or later to resolve the issue. As a temporary workaround, consider restricting the upload of gem files or validating the gem.homepage value in the .gemspec file to prevent malicious input.