{"action":"Upgrade mechanize to 2.14.1 or later.","affected":[{"fixed":"2.14.1","introduced":"0"}],"component":"mechanize","cve_ids":["CVE-2026-107715"],"ecosystem":"RubyGems","epss":0.00501,"exploited":false,"fixed_versions":["2.14.1"],"ghsa_id":"GHSA-2mwr-xjcg-37j7","id":"tcs_01M5KEFZ5FKEEECGN0MD88SEA9","modified_at":"2026-10-08T22:15:07.251994937Z","published_at":"2026-10-08T22:09:00Z","references":["https://osv.dev/vulnerability/GHSA-2mwr-xjcg-37j7","https://github.com/sparklemotion/mechanize/security/advisories/GHSA-2mwr-xjcg-37j7","https://github.com/sparklemotion/mechanize/pull/676","https://github.com/sparklemotion/mechanize/commit/02a1235842d6eda8d4a5a3d8f13aba2cecf52e4f","https://github.com/sparklemotion/mechanize/commit/94e0902867296be804f36eccbb47acf7d5018745","https://github.com/sparklemotion/mechanize/commit/ac49abf2869297d83c3b11bbfb8b18e63b588c95","https://github.com/sparklemotion/mechanize","https://github.com/sparklemotion/mechanize/releases/tag/v2.14.1"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-2mwr-xjcg-37j7","url":"https://osv.dev/vulnerability/GHSA-2mwr-xjcg-37j7"}],"summary":"Mechanize sends credential headers to another host after an HTTP redirect"}