CVE-2021-23435: Thoughtbot Clearance

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).

Affected products

• Thoughtbot Clearance: before 2.5.0 (fixed in 2.5.0)

Published 2021-09-12. Last modified 2026-06-17.