The vulnerability allows an attacker to supply a crafted IFSC code that causes the library to perform HTTP GET requests to arbitrary hosts via URI.join. This results in outbound network traffic from the application, potentially leaking internal resources or enabling data exfiltration. The flaw stems from unsafe handling of user input, identified as CWE-918.

The affected product is the Razorpay IFSC Ruby gem version 2.0.62. Any Ruby application that includes or imports this gem and invokes IFSC.find or IFSC#get with user‑controlled input is potentially vulnerable.

The CVSS score of 6.9 indicates a moderate severity. Because the exploit requires only crafting an IFSC code value, it can be performed through normal API usage, assuming the application accepts user input. The EPSS score is unavailable, but the lack of KEV listing suggests no widespread exploitation yet. Nevertheless, the impact of facilitating uncontrolled outbound requests warrants prompt mitigation.