How AI contributed: Incomplete remediationPublished May 18, 2026 in 
lostisland/faraday
Summary Faraday::Connection#build_exclusive_url still allows protocol-relative host override when the request target is provided as a URI object instead of a String. This bypasses the February 2026 fix for GHSA-33mh-2634-fwr2 and can redirect a request built from a fixed-base Faraday::Connection to an attacker-controlled host while preserving connection-scoped headers such as Authorization. Affected Component · Repository File(s)/Endpoint(s): · lib/faraday/connection.rb · lib/faraday/request.rb · spec/faraday/connection_spec.rb · spec/faraday/request_spec.rb · Function(s): · Faraday::Connection#build_exclusive_url · Faraday::Connection#run_request · Faraday::Request#url · Faraday::Request#to_env · Version(s) Tested: · Faraday 2.14.1 · repository HEAD a01039c948d3e9e41e03d152aed7244f0fb4d5ca Attacker Profile · Who: A remote user who can influence a per-request target/path in an application that uses a fixed-base Faraday connection · Access Required: Ability to supply data that the application converts to URI.parse(...) and passes to conn.get(...), conn.post(...), or req.url(...) · Capability: Control over a protocol-relative URI such as URI("//evil.example/pwn") Steps to Reproduce 1. Use the current repository checkout and load Faraday from lib/. 2. Build a fixed-base connection and provide a protocol-relative URI object to req.url. 3. Observe that the request is actually sent to the attacker-controlled host instead of the configured base host. 4. Observe that the connection-scoped Authorization header remains attached to the off-host request. Verification Evidence · Environment: macOS, Ruby from local environment, Faraday 2.14.1, faraday-net_http, local WEBrick listener on 127.0.0.1:4567, HEAD a01039c948d3e9e41e03d152aed7244f0fb4d5ca · Commands executed: · PoC code (inline): · Exit code: 0 · stdout (relevant excerpt): · stderr (relevant excerpt): · Artifacts: none Additional External Confirmation The issue was also independently reproduced against a public HTTP collector on Faraday 2.14.1 using the default net_http adapter: This external confirmation shows the request is not only misbuilt in memory, but is actually dispatched off-host by a real adapter under normal usage. Supporting Materials · Existing advisory for the original string-based issue: GHSA-33mh-2634-fwr2 · Existing CVE for the original string-based issue: CVE-2026-25765 · Existing regression tests for the string-only fix: · spec/faraday/connection_spec.rb:314-345 · Existing test proving supported URI request input: · spec/faraday/request_spec.rb:26-31 Impact The direct consequence is off-host request forgery from code paths that believe they are constrained to a fixed base URL. If the connection carries default headers or query parameters, those values are forwarded to the attacker-selected host.
Claude merge-from-fork extends the string protocol-relative guard with start_with?('//'). URI objects skip the guard because they do not respond to start_with?. Later human fix adds url.to_s before the string guard. Distinct from GHSA-33mh string protocol-relative SSRF.
Case facts
ClaudeOnly the highlighted steps are this advisory. The first step is the earlier flaw the AI tried, and failed, to close.
Original flaw
Earlier advisory · GHSA-33MH-2634-FWR2Sink: lib/faraday/connection.rb Faraday::Connection#build_exclusive_url
Originally written by ykrods
This advisoryCVE-2026-33637 (GHSA-5RV5-XJ5J-3484)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Applied the check only to strings, not URI objects.
Incomplete AI-assisted fix · Claude
Fixed again
This is the patch that actually stops the same attack path.
Fix by Tomoya Yamashita · no AI marker found
--- a/.rubocop_todo.yml+++ b/.rubocop_todo.yml@@ -31,7 +31,7 @@ Metrics/AbcSize: # Offense count: 3 # Configuration parameters: CountComments, CountAsOne. Metrics/ClassLength:- Max: 230+ Max: 235 # Offense count: 9 # Configuration parameters: AllowedMethods, AllowedPatterns.--- a/lib/faraday/connection.rb+++ b/lib/faraday/connection.rb@@ -481,8 +481,9 @@ module Faraday if url && !base.path.end_with?('/') base.path = "#{base.path}/" # ensure trailing slash end- # Ensure relative url will be parsed correctly (such as `service:search` )- url = "./#{url}" if url.respond_to?(:start_with?) && !url.start_with?('http://', 'https://', '/', './', '../')+ # Ensure relative url will be parsed correctly (such as `service:search` or `//evil.com`)+ url = "./#{url}" if url.respond_to?(:start_with?) &&+ (!url.start_with?('http://', 'https://', '/', './', '../') || url.start_with?('//')) uri = url ? base + url : base if params uri.query = params.to_query(params_encoder || options.params_encoder)--- a/spec/faraday/connection_spec.rb+++ b/spec/faraday/connection_spec.rb@@ -311,6 +311,39 @@ RSpec.describe Faraday::Connection do end end + context 'with protocol-relative URL (GHSA-33mh-2634-fwr2)' do+ it 'does not allow host override with //evil.com/path' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url('//evil.com/path')+ expect(uri.host).to eq('httpbingo.org')+ end++ it 'does not allow host override with //evil.com:8080/path' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url('//evil.com:8080/path')+ expect(uri.host).to eq('httpbingo.org')+ end++ it 'does not allow host override with //user:[email protected]/path' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url('//user:[email protected]/path')+ expect(uri.host).to eq('httpbingo.org')+ end++ it 'does not allow host override with ///evil.com' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url('///evil.com')+ expect(uri.host).to eq('httpbingo.org')+ end++ it 'still allows single-slash absolute paths' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url('/safe/path')+ expect(uri.host).to eq('httpbingo.org')+ expect(uri.path).to eq('/safe/path')+ end+ end+ context 'with a custom `default_uri_parser`' do let(:url) { 'http://httpbingo.org' } let(:parser) { Addressable::URI }--- a/.rubocop_todo.yml+++ b/.rubocop_todo.yml@@ -38,12 +38,12 @@ Metrics/AbcSize: # Offense count: 4 # Configuration parameters: CountComments, CountAsOne. Metrics/ClassLength:- Max: 231+ Max: 233 # Offense count: 8 # Configuration parameters: AllowedMethods, AllowedPatterns. Metrics/CyclomaticComplexity:- Max: 13+ Max: 14 # Offense count: 28 # Configuration parameters: CountComments, CountAsOne, AllowedMethods, AllowedPatterns.--- a/lib/faraday/connection.rb+++ b/lib/faraday/connection.rb@@ -481,9 +481,11 @@ module Faraday if url && !base.path.end_with?('/') base.path = "#{base.path}/" # ensure trailing slash end+ url = url.to_s if url.respond_to?(:host) # Ensure relative url will be parsed correctly (such as `service:search` or `//evil.com`) url = "./#{url}" if url.respond_to?(:start_with?) &&- (!url.start_with?('http://', 'https://', '/', './', '../') || url.start_with?('//'))+ (url.start_with?('//') ||+ !url.start_with?('http://', 'https://', '/', './', '../')) uri = url ? base + url : base if params uri.query = params.to_query(params_encoder || options.params_encoder)--- a/spec/faraday/connection_spec.rb+++ b/spec/faraday/connection_spec.rb@@ -318,6 +318,13 @@ RSpec.describe Faraday::Connection do expect(uri.host).to eq('httpbingo.org') end + it 'does not allow host override with URI("//evil.com/path")' do+ conn.url_prefix = 'http://httpbingo.org/api'+ uri = conn.build_exclusive_url(URI('//evil.com/path?token=1'))+ expect(uri.host).to eq('httpbingo.org')+ expect(uri.query).to eq('token=1')+ end+ it 'does not allow host override with //evil.com:8080/path' do conn.url_prefix = 'http://httpbingo.org/api' uri = conn.build_exclusive_url('//evil.com:8080/path')AI-assisted change f1abda3e9e02d602ce2c6bebbf2199a3c9cf0a4415e2bcec6eaa5b010457c008 · Fix c3b9774d54dc49b8b16d1e974758417e0fcefc2cfcd4272d68929b419ca5b585