CVE-2025-27220: Ruby-Lang Cgi

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.

Affected products

• Ruby-Lang Cgi: before 0.3.5.1 (fixed in 0.3.5.1); from 0.4.0, before 0.4.2 (fixed in 0.4.2); version 0.3.6 only

Published 2025-03-04. Last modified 2026-06-17.