Gemirro Stored XSS in Gemspec "homepage" value (GHSA-x7p2-x2j6-mwhr)
Published: 2017-11-29T23:19:51Z
Aliases: CVE-2017-16833
Severity: MODERATE · CWE: CWE-79

Stored cross-site scripting (XSS) vulnerability in Gemirro before 0.16.0 allows attackers to inject arbitrary web script via a crafted javascript: URL in the "homepage" value of a ".gemspec" file.
A ".gemspec" file must be created with a JavaScript URL in the homepage  value. This can be used to build a gem for upload to the Gemirro server, in order to achieve stored XSS via the author name hyperlink.

Affected packages:
package: ecosystem: RubyGems
name: gemirro
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.16.0