Rack's directory listing generates an anchor for every file on disk. If a file's name begins with the javascript: scheme, the href in the generated index becomes that exact value, allowing the browser to execute JavaScript. This stored XSS flaw can be abused to run arbitrary code, steal session data, or redirect users. The weakness is classified as CWE‑79.

The flaw affects Rack library versions older than 2.2.22, 3.1.20, and 3.2.5 in Ruby web applications. Any environment running those versions with Rack::Directory enabled and publicly accessible directory listings is vulnerable.

The vulnerability has a CVSS score of 5.4, indicating moderate severity. Its EPSS is below 1%, suggesting low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation requires the presence of a file whose basename starts with "javascript:" on the server and a user to click the resulting link in a directory listing, so it is an indirect, user‑side vector.