ddnexus CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM ddnexus CVE published 2026-07-28

CVE-2026-54659

CVE-2026-54659 is a vulnerability in the Pagy gem, a pagination library for Ruby. The vulnerability allows an attacker to read arbitrary YAML files by providing a specially crafted locale value. This issue arises from the Pagy::I18n.locale= method in gem/lib/pagy/modules/i18n/i18n.rb storing locale values verbatim and using them as <locale>.yml path components. The vulnerability is fixed in version 43.5.6 [truncated]