Mechanize EUVD-2026-95318

Three conditions must hold simultaneously: (1) Mechanize#follow_meta_refresh must be explicitly enabled - it defaults to false, so default deployments are NOT affected; (2) the caller must have set sensitive default headers (e.g., Authorization bearer token or Cookie) via Mechanize#request_headers=, since exposure is limited to those caller-supplied defaults; and (3) the attacker must control page content within the crawl so they can serve a meta refresh pointing to an origin they control. Limiting factors: the non-default feature flag and the requirement that the victim configure credentials as global default headers both substantially reduce realistic exposure, which is reflected in the AC:H rating. Affected versions are all releases prior to 2.14.1.

This is a genuine but conditional information-disclosure flaw (CWE-200) rather than a broadly exploitable critical issue. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N, 6.8 Medium) is internally consistent with the description: network vector because the attacker only needs to control crawled web content, AC:H because exploitation depends on a non-default configuration (follow_meta_refresh enabled) AND the caller having set sensitive default headers via request_headers=, scope change (S:C) because credentials scoped to one origin leak to an attacker-controlled origin, and C:H/I:N/A:N because only confidentiality (bearer tokens, session cookies) is affected. No EPSS score, KEV listing, or POC was supplied in the input. No public exploit is identified at time of analysis, and there is no evidence of active exploitation. The vendor explicitly states the default configuration is NOT affected (follow_meta_refresh defaults to false) and exposure is limited to caller-supplied default headers - two independent conditions that sharply narrow the real-world attack surface. Net assessment: a legitimate credential-leak bug worth patching for anyone running Mechanize as an authenticated crawler with meta-refresh following enabled, but low urgency for the typical deployment running defaults. Treat as a dependency-hygiene update, not an emergency.

A developer runs a Mechanize-based crawler with follow_meta_refresh enabled and configures a default Authorization or Cookie header (e.g., a bearer token) via Mechanize#request_headers= to authenticate to a trusted site. An attacker who can plant content on a page in the crawl path serves an HTML meta refresh pointing to an attacker-controlled origin; Mechanize follows it and re-applies the configured credential headers, delivering the bearer token or session cookie to the attacker. No public exploit code was provided in the input, and the high attack complexity (non-default config plus caller-set sensitive headers) limits practicality.