[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsDfr09bu-klqXKZ7v_73mV6zHbsxoDnMZpdOrJYNa6k":3,"g5a-risk:CVE-2025-27220":139},{"success":4,"data":5,"meta":136},true,{"cveId":6,"title":7,"description":8,"shortDescription":8,"publishedDate":9,"lastModified":10,"cvssScore":11,"cvssVector":12,"cvssMetrics":13,"epssScore":40,"epssPercentile":28,"epssTimeSeries":41,"severity":42,"affectedProducts":43,"affectedProductsCount":26,"references":60,"referencesCount":75,"weaknesses":76,"weaknessesCount":85,"isActivelyExploited":56,"cisaInfo":28,"otxData":28,"relatedBlogPosts":86,"seoMetadata":87,"configurations":112,"relatedVendorCves":134,"notableEvents":135},"CVE-2025-27220","What is CVE-2025-27220?","In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of Service (ReDoS) vulnerability exists in the Util#escapeElement method.","2025-03-04T00:15:31.693","2025-11-03T22:18:43.61",7.5,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H",{"CVSSMetricV31":14,"CVSSMetricV30":38,"CVSSMetricV2":39,"CVSSMetricV40":28},[15,31],{"Source":16,"Type":17,"CVSSData":18,"ExploitabilityScore":29,"ImpactScore":30},"cve@mitre.org","Secondary",{"Version":19,"VectorString":20,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":25,"BaseScore":26,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:C\u002FC:N\u002FI:N\u002FA:L","NETWORK","HIGH","NONE","CHANGED","LOW",4,"MEDIUM",null,2.2,1.4,{"Source":32,"Type":33,"CVSSData":34,"ExploitabilityScore":36,"ImpactScore":37},"nvd@nist.gov","Primary",{"Version":19,"VectorString":12,"AttackVector":21,"AttackComplexity":25,"PrivilegesRequired":23,"UserInteraction":23,"Scope":35,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":22,"BaseScore":11,"BaseSeverity":22,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"UNCHANGED",3.9,3.6,[],[],0.0076,[40,40,40,40,40,40,40],"High",[44,49,52,57],{"vendor":45,"product":46,"version":47,"criteria":48,"vulnerable":4},"ruby-lang","cgi","*","cpe:2.3:a:ruby-lang:cgi:*:*:*:*:*:ruby:*:*",{"vendor":45,"product":46,"version":50,"criteria":51,"vulnerable":4},"0.3.6","cpe:2.3:a:ruby-lang:cgi:0.3.6:*:*:*:*:ruby:*:*",{"vendor":45,"product":53,"version":54,"criteria":55,"vulnerable":56},"ruby","3.1.0","cpe:2.3:a:ruby-lang:ruby:3.1.0:*:*:*:*:*:*:*",false,{"vendor":45,"product":53,"version":58,"criteria":59,"vulnerable":56},"3.2.0","cpe:2.3:a:ruby-lang:ruby:3.2.0:*:*:*:*:*:*:*",[61,66,71],{"url":62,"source":63,"tags":64},"https:\u002F\u002Fgithub.com\u002Frubysec\u002Fruby-advisory-db\u002Fblob\u002Fmaster\u002Fgems\u002Fcgi\u002FCVE-2025-27220.yml","GitHub",[65],"Third Party Advisory",{"url":67,"source":68,"tags":69},"https:\u002F\u002Fhackerone.com\u002Freports\u002F2890322","Hackerone",[70],"Permissions Required",{"url":72,"source":73,"tags":74},"https:\u002F\u002Flists.debian.org\u002Fdebian-lts-announce\u002F2025\u002F03\u002Fmsg00008.html","Debian",[],3,[77],{"id":78,"name":79,"description":80,"extendedDescription":81,"status":82,"abstraction":83,"structure":84},"CWE-1333","Inefficient Regular Expression Complexity","The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.","Some regular expression engines have a feature called \"backtracking\". If the token cannot match, the engine \"backtracks\" to a position that may result in a different token that can match.\n                Backtracking becomes a weakness if all of these conditions are met:","Draft","Base","Simple",1,[],{"title":88,"metaDescription":89,"keywords":90,"canonicalUrl":91,"structuredData":92},"What is CVE-2025-27220? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2025-27220, a high severity cyber security vulnerability from 2025. In the CGI gem before 0.4.2 for Ruby, a Regular Expression ...","CVE-2025-27220, CVE-2025-27220 vulnerability, CVE-2025-27220 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2025, CVSS score, exploit, patch, remediation, ruby-lang security, cgi vulnerability, ruby vulnerability","\u002Fwhat-is\u002Fcve-2025-27220",{"@context":93,"@type":94,"headline":88,"description":89,"datePublished":9,"dateModified":10,"author":95,"publisher":99,"about":103,"mainEntityOfPage":107,"articleSection":110,"keywords":111},"https:\u002F\u002Fschema.org","TechArticle",{"@type":96,"name":97,"url":98},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":96,"name":97,"url":98,"logo":100},{"@type":101,"url":102},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":104,"name":6,"description":105,"additionalType":106},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":108,"@id":109},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2025-27220","Cybersecurity","CVE-2025-27220, CVE-2025-27220 vulnerability, CVE-2025-27220 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[113],{"Operator":114,"Negate":28,"Nodes":115},"AND",[116,128],{"Operator":117,"Negate":56,"CPEMatch":118},"OR",[119,122,126],{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":120,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":121,"VersionEndIncluding":28},"E7161F63-FEE1-4803-A460-FE87E323B05D","0.3.5.1",{"Vulnerable":4,"Criteria":48,"MatchCriteriaID":123,"VersionStartExcluding":28,"VersionStartIncluding":124,"VersionEndExcluding":125,"VersionEndIncluding":28},"A30117BA-C46E-44BB-A581-86E43F37D6E4","0.4.0","0.4.2",{"Vulnerable":4,"Criteria":51,"MatchCriteriaID":127,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"8AE1C5F9-0743-49A2-8292-0018FEEF81E0",{"Operator":117,"Negate":56,"CPEMatch":129},[130,132],{"Vulnerable":56,"Criteria":55,"MatchCriteriaID":131,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"DD748C02-1E5E-4D92-9C41-2BF953874C32",{"Vulnerable":56,"Criteria":59,"MatchCriteriaID":133,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":28,"VersionEndIncluding":28},"8850AECE-0966-403B-A0D8-694C3ECE39D4",[],[],{"lastModified":10,"cacheTime":137,"version":138},1792258047497,"2.0",{"score":140,"band":141,"action":142,"scoredAt":143},46,"Medium","Plan remediation","2026-10-16T07:06:10.542853+00:00"]