The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies
    no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when
    Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes
    headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an
    attacker who controls content in the crawl to capture bearer tokens or session cookies. The default
    configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-
    supplied default headers. This issue is fixed in version 2.14.1. (CVE-2026-107399)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies     no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when     Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes     headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an     attacker who controls content in the crawl to capture bearer tokens or session cookies. The default     configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-     supplied default headers. This issue is fixed in version 2.14.1. (CVE-2026-107399)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473938	SCA: security update for mechanize (GHSA-c6rp-p8xm-4q9f)	Tenable Cloud Security	SCA Checks	Local	medium
473938	SCA: security update for mechanize (GHSA-c6rp-p8xm-4q9f)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
364421	Linux Distros Unpatched Vulnerability : CVE-2026-107399	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-107399

medium

Tenable Plugins

medium

medium

medium