CVE-2026-44587: CWE-625: Permissive Regular Expression in carrierwaveuploader carrierwave
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.
AI Analysis
Technical Summary
CarrierWave's content_type_denylist feature improperly interpolates denylist entries into regular expressions without escaping regex metacharacters or anchoring, causing entries like image/svg+xml to be treated incorrectly (e.g., '+' treated as a quantifier). This flaw allows MIME types intended to be blocked to bypass the denylist silently. Consequently, applications relying on this denylist to block SVG uploads are vulnerable to stored XSS attacks via malicious SVG files containing JavaScript. The vulnerability affects versions prior to 2.2.7 and 3.1.3 and has been addressed in those fixed releases.
Potential Impact
Applications using vulnerable CarrierWave versions with content_type_denylist to block certain MIME types such as image/svg+xml are silently unprotected, allowing attackers to upload SVG files with embedded JavaScript. If these SVG files are served inline from the same origin, the malicious script executes in users' browsers, resulting in stored cross-site scripting (XSS). This can lead to client-side code execution and potential compromise of user sessions or data.
Mitigation Recommendations
Upgrade CarrierWave to version 2.2.7 or later, or 3.1.3 or later, where the issue is fixed by properly escaping regex metacharacters and anchoring denylist entries. No other mitigation is specified or required as the fix is available in these official releases.
CVE-2026-44587: CWE-625: Permissive Regular Expression in carrierwaveuploader carrierwave
Description
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In lib/carrierwave/uploader/content_type_denylist.rb:57, denylist entries are interpolated directly into a regex without Regexp.quote or anchoring, so an entry such as image/svg+xml becomes the pattern /image\/svg+xml/, in which + is treated as a quantifier rather than a literal character and therefore never matches the real MIME type image/svg+xml. This is inconsistent with the allowlist implementation, which correctly applies both Regexp.quote and a \A anchor. Other content types containing regex metacharacters, such as application/xhtml+xml, are affected as well. As a result, any application that relies on content_type_denylist to block image/svg+xml, most commonly to prevent stored XSS, is silently unprotected. An attacker can upload an SVG file containing arbitrary JavaScript; if the application serves that SVG inline from its own origin, the script executes in the victim's browser, resulting in stored XSS. This issue has been fixed in versions 2.2.7 and 3.1.3.
CVSS v3.1
Score 4.7medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CarrierWave's content_type_denylist feature improperly interpolates denylist entries into regular expressions without escaping regex metacharacters or anchoring, causing entries like image/svg+xml to be treated incorrectly (e.g., '+' treated as a quantifier). This flaw allows MIME types intended to be blocked to bypass the denylist silently. Consequently, applications relying on this denylist to block SVG uploads are vulnerable to stored XSS attacks via malicious SVG files containing JavaScript. The vulnerability affects versions prior to 2.2.7 and 3.1.3 and has been addressed in those fixed releases.
Potential Impact
Applications using vulnerable CarrierWave versions with content_type_denylist to block certain MIME types such as image/svg+xml are silently unprotected, allowing attackers to upload SVG files with embedded JavaScript. If these SVG files are served inline from the same origin, the malicious script executes in users' browsers, resulting in stored cross-site scripting (XSS). This can lead to client-side code execution and potential compromise of user sessions or data.
Mitigation Recommendations
Upgrade CarrierWave to version 2.2.7 or later, or 3.1.3 or later, where the issue is fixed by properly escaping regex metacharacters and anchoring denylist entries. No other mitigation is specified or required as the fix is available in these official releases.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-06T21:49:12.425Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a31e0310b89be68884d66df
Added to database: 06/16/2026, 23:45:53 UTC
Last enriched: 06/24/2026, 16:11:37 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 83
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.