sinatrarb 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に パス処理の欠陥 and vendor risk cross-site scripting などに関し、一部は vendor impact session compromise を招き、vendor surface production workloads and vendor surface software deployment 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-61921 | Sinatra is a domain-specific language for creating web applications in Ruby. In versions prior to 4.2.0, there is a denial of service vulnerability in the `If-Match` and `If-None-Match` header parsing component of Sinatra, if the `etag` method is used when constructing the response. Carefully crafted input can cause `If-Match` and `If-None-Match` header parsing in Sinatra to take an unexpected amount of time, possibly resulting in a denial of service attack vector. This header is typically invol | [email protected] | 2.7 | 0.52% | 2025-10-10 | 2025-10-31 |
| CVE-2022-45442 | Sinatra is a domain-specific language for creating web applications in Ruby. An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. Version 2.2.3 and 3.0.4 contain patches for this issue. | [email protected] | 8.8 | 0.36% | 2022-11-28 | 2025-11-04 |
| CVE-2022-29970 | Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files. | [email protected] | 7.5 | 0.60% | 2022-05-02 | 2025-11-04 |
| CVE-2018-11627 | Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception. | [email protected] | 6.1 | 0.40% | 2018-05-31 | 2024-11-21 |
| CVE-2018-1000119 | Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0. | [email protected] | 5.9 | 0.43% | 2018-03-07 | 2024-11-21 |
| CVE-2018-7212 | An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters. | [email protected] | 5.3 | 0.21% | 2018-02-18 | 2024-11-21 |