A medium-severity CVE (CVE-2026-44587) has been disclosed in the CarrierWave Ruby gem. The `content_type_denylist` check interpolates string entries directly into a regex without escaping metacharacters using `Regexp.quote`. This means a denylist entry like `image/svg+xml` becomes the regex `/image\/svg+xml/` where `+` acts as a quantifier rather than a literal character, causing the regex to never match the actual MIME type. Applications relying on this denylist to block SVG uploads — commonly done to prevent stored XSS — are silently unprotected. The fix, available in versions ~> 2.2.7 and >= 3.1.3, applies `Regexp.quote` and anchors the pattern with `\A`, matching the existing allowlist implementation.
404 Impressions