CVE-2026-44587

creationtimestamp| type| source ---|---|--- 2026-05-23 05:40:33+00:00| published-proof-of-concept| https://github.com/carrierwaveuploader/carrierwave/security/advisories/GHSA-7g26-2qgj-chfg 2026-06-17 03:43:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mohfhrsnfp2j...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the allowlistedcontenttype? function. An attacker can bypass the Content-Type allowlist, potentially leading to the exploitation of this vulnerability by passing a crafted value as the contenttype argument...