CVE-2026-54659

RubyGems/pagy CVE-2026-54659: medium

Pagy I18n locale option is not validated before being used in a file path

Action: Upgrade pagy to 43.5.6 or later.

bundle update pagy

Affected

Fixed versions

Sources

• osv: GHSA-2xmw-f8j8-wfxc
• https://github.com/ddnexus/pagy/security/advisories/GHSA-2xmw-f8j8-wfxc
• https://github.com/ddnexus/pagy/pull/908
• https://github.com/ddnexus/pagy/commit/efcf09690e9fa7d7abdfb987b785a55f87e287df
• https://github.com/ddnexus/pagy
• https://github.com/ddnexus/pagy/releases/tag/43.5.6

CVE-2026-54659 · published 2026-07-28T22:25:29Z · modified 2026-07-28T22:41:45.721426Z · JSON