Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

[santiagodoldan]

Looks like a Sinatra vulnerability was reported here GHSA-hxx2-7vcw-mqr3.

[gravitystorm]

A new version of sinatra, 4.1.0, has now been released and that version fixes this CVE.

sinatra/sinatra@73f3291

However, mailcatcher depends on "sinatra", "~> 3.2". It would be great if the dependency on sinatra is relaxed, to pick up the sinatra 4.x series too.

[tbone587]

Just came across this. Would be nice to get rid of the sinatra cve!

[spaquet]

I just suggested a massive PR with a bunch of upgrade to operate more recent Rack, Sinatra and Thin
#573

My fork is here if interested to pull from it while waiting for the maintainer to upgrade https://github.com/spaquet/mailcatcher

[bartread]

@spaquet This is wonderful - thank you.

I was wondering if the project was dead because I just tried to update our Mailcatcher gem to 0.10.0 in response to a dependabot alert and then realised that doing so had introduced two CVEs, one of which dates back to 2024. Checked for a more recent version, but no.

EDIT: Ah... just noticed you'd closed the PR again.