CVE-2025-61594 Ruby-Lang — Exploit & Vulnerability Details LOW

Parameter	Value
CVSS	2.1 (LOW)
Affected Versions	0.13.0 — 1.0.4
Fixed In	0.12.5
Type	CWE-200 (Information Exposure), CWE-212
Vendor	Ruby-Lang
Public PoC	No

URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundled in Ruby 3.3 series), 1.0.3 and earlier (bundled in Ruby 3.4 series), when using the + operator to combine URIs, sensitive information like passwords from the original URI can be leaked, violating RFC3986 and making applications vulnerable to credential exposure. This is a a bypass for the fix to CVE-2025-27221 that can expose user credentials.

This issue has been fixed in versions 0.12.5, 0.13.3 and 1.0.4.

Attack Parameters

Attack Vector

Local

Requires local access

Attack Complexity

Low

Easy to exploit

Attack Requirements

Present

Additional conditions required

Privileges Required

None

No privileges needed

User Interaction

None

No user interaction needed

Impact Assessment

Confidentiality

None

No data leak

Integrity

None

No data modification

Availability

None

No disruption

CVSS Vector v4.0

Weakness Type (CWE)

CWE-200 Information Exposure

CWE-212

Vulnerable Products 3

Configuration	From (including)	Up to (excluding)
Ruby-Lang Uri cpe:2.3:a:ruby-lang:uri::::::ruby::*	—	`0.12.5`
Ruby-Lang Uri cpe:2.3:a:ruby-lang:uri::::::ruby::*	`0.13.0`	`0.13.3`
Ruby-Lang Uri cpe:2.3:a:ruby-lang:uri::::::ruby::*	`1.0.0`	`1.0.4`