Addressable display_uri can show misleading hosts containing bidi and invisible characters
CVE-2026-126349
Impact Addressable::IDNA.tounicode decodes Punycode labels (labels beginning with xn--) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. Addressable::URI#displayuri uses tounicode, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of http://xn--abcmoc-dm0c.com/ is displayed as abc, U+202E, moc.com, and the override makes everything after abc render right to left. Parsing, host, normalizedhost and any connection made from the URI are not affected. Only the displayed form is. Applications that show displayuri to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one. In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits. In the native IDNA implementation, used when libidn and the idn-ruby gem are installed, libidn rejects most of them, but not characters added to…
Assessment
- CVSS
- 3.1 (v3.1)
- Severity
- Low
- EPSS
- 0.00245% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 12 November 2026
- Last updated
- 12 November 2026
- Affected
- addressable
- Weakness
- CWE-1007, CWE-176, CWE-451
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
At the source
References
- https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg
- https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/addressable/GHSA-539f-xcgw-2gjg.yml
- https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1
- https://github.com/advisories/GHSA-539f-xcgw-2gjg
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-126349