The flaw lies in the Faraday HTTP client’s build_exclusive_url method, which merges a base URL with a user‑supplied path using Ruby’s URI#merge. When a protocol‑relative URL (starting with //) is supplied, RFC 3986 dictates that the host component overrides the base URL’s authority. Consequently, an attacker can craft a request such as //attacker.com/endpoint, causing Faraday to redirect outgoing HTTP calls to an arbitrary host. This enables the attacker to access internal resources, exfiltrate data, or pivot laterally from the vulnerable application, representing a Server‑Side Request Forgery issue. The CVSS score of 5.8 reflects a moderate severity, as the attack requires the application to forward user input to the Faraday API.

This vulnerability affects the Faraday project, provided by lostisland. All releases before version 2.14.1 are susceptible. The fix was delivered in 2.14.1, so any deployment that has not upgraded to 2.14.1 or newer remains at risk.

The EPSS score is < 1%, indicating a low exploitation probability at present, and faraday is not listed in the CISA KEV catalog. The most common attack vector is application‑level: if software receives untrusted input and forwards it unchecked to Faraday’s get, post, or build_url methods, the attacker controls the request destination. Exploitation does not require privileged credentials but relies on the ability to influence the URL supplied to the client. The presence of CWEs 918 and 1289 underscores the lack of input validation and potential certificate validation deficiencies.