CVE-2026-54659 Details

A vulnerability exists in the Pagy pagination library for Ruby, specifically in versions 43.0.0 prior to 43.5.6. The issue arises in the I18n module, where the locale setter method does not validate input before using it to construct file paths for loading translation dictionaries. This flaw allows untrusted parameters to manipulate the file path, potentially leading to unauthorized access to sensitive YAML files, such as application configuration files. The vulnerability is exploitable in applications that pass raw user input into the Pagy locale setting.

Users can upgrade to Pagy version 43.5.6, which addresses the vulnerability by validating the locale input against a BCP 47 pattern before using it in file path constructions. If an upgrade is not possible, the locale should be validated manually before assignment, ensuring it conforms to expected formats.