PT-2025-13256 · Rack+1 · Rack+1

Published 2025-03-27 · Updated 2025-03-28 · CVE-2025-30221

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pitchfork versions prior to 0.11.0

Description The issue concerns HTTP Response Header Injection when Pitchfork is used with Rack 3. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 0.11.0, update to version 0.11.0 to resolve the issue. As a temporary workaround, consider restricting access to the HTTP server until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2025-30221

GHSA-PFQJ-W6R6-G86V

Affected Products

Pitchfork

Rack

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30221.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/pitchfork/CVE-2025-30221.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30221 · Security Note
• https://osv.dev/vulnerability/GHSA-pfqj-w6r6-g86v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-30221 · Vendor Advisory
• https://github.com/Shopify/pitchfork/security/advisories/GHSA-pfqj-w6r6-g86v · Note
• https://github.com/Shopify/pitchfork/commit/17ed9b61bf9f58957065f7405b66102daf86bf55 · Note
• https://github.com/Shopify/pitchfork · Note
• https://t.me/cvedetector/21299 · Telegram Post
• https://twitter.com/CVEnew/status/1905300632938184994 · Twitter Post
• https://twitter.com/rubylandnews/status/1905656225062162612 · Twitter Post