Cross-Site Scripting (XSS)

geminabox is vulnerable to cross-site scripting XSS attacks. It is possible because the spec.homepage and the spec.email parameters are not sanitized, allowing the attackers to trigger XSS by sending a .gem file with gem.homepage value in its .gemspec file...