OSV-2026-1220

See a problem?
Import Source
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2026-1220.yaml
JSON Data
https://api.osv.dev/v1/vulns/OSV-2026-1220
Published
2026-08-31T00:03:15Z
Modified
2026-09-11T14:26:10Z
Summary
Use-of-uninitialized-value in str_escape
Details

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=554268877

Crash type: Use-of-uninitialized-value
Crash state:
str_escape
mrb_vm_exec
yield_with_attr
References

Affected packages

OSS-Fuzz / mruby

Package

Name
mruby
Purl
pkg:generic/mruby

Affected ranges

Type
GIT
Repo
https://github.com/mruby/mruby
Events
Introduced
18c43c2a5add8cbd91f094b08bb4fc291a019a82
Fixed
cafbd6691d971b110dcaedf64b37833d7a4f34cf

Affected versions

4.*
4.0.0
4.0.0-rc
4.0.0-rc2
4.0.0-rc3
4.0.0-rc4
4.1.0-rc
4.1.0-rc2

Ecosystem specific 

{
    "severity": "MEDIUM"
}

Database specific

fixed_range 
"b41b20aa96cb0d1fbe57acf0d30d547ccf94af3b:cafbd6691d971b110dcaedf64b37833d7a4f34cf"
introduced_range 
"65247613b9d250403a5fd0c044da4384974ddd04:1d426c50bff9a26b6b6d79199684140db2fe94b2"
source 
"https://github.com/google/oss-fuzz-vulns/blob/main/vulns/mruby/OSV-2026-1220.yaml"