{"action":"Upgrade excon to 1.5.0 or later.","affected":[{"fixed":"1.5.0","introduced":"0"}],"component":"excon","cve_ids":["CVE-2026-54171"],"ecosystem":"RubyGems","epss":0.00427,"exploited":false,"fixed_versions":["1.5.0"],"ghsa_id":"GHSA-48rx-c7pg-q66r","id":"tcs_01M5KEGHYHWP9ZHBE8MSES2PDR","modified_at":"2026-09-10T03:50:51.410739140Z","published_at":"2026-07-10T20:37:29Z","references":["https://osv.dev/vulnerability/GHSA-48rx-c7pg-q66r","https://github.com/excon/excon/security/advisories/GHSA-48rx-c7pg-q66r","https://nvd.nist.gov/vuln/detail/CVE-2026-54171","https://github.com/excon/excon/pull/901","https://github.com/excon/excon/commit/ea89a35308a12f4b791b6c50f2cbd33f94889fa3","https://github.com/excon/excon","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2026-54171.yml","https://www.cve.org/CVERecord?id=CVE-2026-54171"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-48rx-c7pg-q66r","url":"https://osv.dev/vulnerability/GHSA-48rx-c7pg-q66r"}],"summary":"Excon does not redact additional sensitive/risky headers when following redirects"}