{"action":"Upgrade uri to 0.11.3 or later.","affected":[{"fixed":"0.11.3","introduced":"0"},{"fixed":"0.12.4","introduced":"0.12.0"},{"fixed":"0.13.2","introduced":"0.13.0"},{"fixed":"1.0.3","introduced":"1.0.0"}],"component":"uri","cve_ids":["CVE-2025-27221"],"ecosystem":"RubyGems","epss":0.00511,"exploited":false,"fixed_versions":["0.11.3","0.12.4","0.13.2","1.0.3"],"ghsa_id":"GHSA-22h5-pq3x-2gf2","id":"tcs_01M5KEFRZJ17P9YSBQJECVCEYG","modified_at":"2026-09-10T03:50:06.344750316Z","published_at":"2025-03-03T22:07:53Z","references":["https://osv.dev/vulnerability/GHSA-22h5-pq3x-2gf2","https://nvd.nist.gov/vuln/detail/CVE-2025-27221","https://github.com/ruby/uri/pull/154","https://github.com/ruby/uri/pull/155","https://github.com/ruby/uri/pull/156","https://github.com/ruby/uri/pull/157","https://hackerone.com/reports/2957667","https://github.com/ruby/uri","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml","https://lists.debian.org/debian-lts-announce/2025/03/msg00008.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00015.html","https://www.cve.org/CVERecord?id=CVE-2025-27221","https://www.ruby-lang.org/en/news/2025/02/26/security-advisories"],"severity":{"label":"low","score":3.2},"sources":[{"source":"osv","source_id":"GHSA-22h5-pq3x-2gf2","url":"https://osv.dev/vulnerability/GHSA-22h5-pq3x-2gf2"}],"summary":"URI allows for userinfo Leakage in URI#join, URI#merge, and URI#+"}