---
id: "CVE-2026-126349"
page: "https://infrastack.ai/live/CVE-2026-126349"
kind: "vulnerability"
aliases: ["CVE-2026-126349", "GHSA-539f-xcgw-2gjg"]
title: "Addressable display_uri can show misleading hosts containing bidi and invisible characters"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "addressable", "fixed": ["2.9.1"], "affected": ">= 2.0.0, < 2.9.1", "ecosystem": "rubygems"}]
ecosystems: ["rubygems"]
tags: ["addressable", "cwe-1007", "cwe-176", "cwe-451", "package", "rails", "ruby"]
not_affected_if: ["no-display-uri-output", "uses-normalized-host-only"]
published_at: "2026-11-12T22:19:20+00:00"
first_seen_at: "2026-11-12T22:40:37+00:00"
updated_at: "2026-11-12T22:48:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126349", "first_seen_at": "2026-11-12T22:40:37+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-539f-xcgw-2gjg", "first_seen_at": "2026-11-12T22:47:10+00:00"}]
exploit_sources: []
---

# Addressable display_uri can show misleading hosts containing bidi and invisible characters

Link for people: https://infrastack.ai/live/CVE-2026-126349 (this .md is for agents)

Addressable's display_uri decodes Punycode hosts containing bidirectional and invisible Unicode characters, so a malicious domain can be shown looking like a trusted one. The parsed host and connections are not affected; only the displayed text is misleading.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- rubygems:addressable affected >= 2.0.0, < 2.9.1 fixed 2.9.1

## How to check

- Check the version of addressable in `Gemfile.lock` (look for `addressable (`) and compare with `2.9.1`.
- Search application code for `display_uri` and for places where its output is shown to users, such as link previews, chat, email or admin screens.

## Fix

- `addressable` `2.9.1` (fixed version; affected range is `>= 2.0.0, < 2.9.1`)

## Timeline

- 2026-11-12T22:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126349
- 2026-11-12T22:47:10+00:00 ghsa https://github.com/advisories/GHSA-539f-xcgw-2gjg

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sporkmonger/addressable/security/advisories/GHSA-539f-xcgw-2gjg
- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/sporkmonger/addressable/security-advisories/GHSA-539f-xcgw-2gjg
- [fix] Patch: github.com https://github.com/sporkmonger/addressable/commit/60455d32bb59fda2585a0e1865a9fcb21e8e55b1
- [fix] Release: github.com https://github.com/sporkmonger/addressable/releases/tag/addressable-2.9.1

## From the sources

### Impact

`Addressable::IDNA.to_unicode` decodes Punycode labels (labels beginning with `xn--`) that contain characters which change how text is displayed without being visible themselves. These include bidirectional controls such as U+202E RIGHT-TO-LEFT OVERRIDE and U+2066–U+2069, zero-width characters, and other invisible format characters. `Addressable::URI#display_uri` uses `to_unicode`, so it can display a host whose characters appear reordered or which looks identical to a different host. For example, the host of `http://xn--abcmoc-dm0c.com/` is displayed as `abc`, U+202E, `moc.com`, and the override makes everything after `abc` render right to left.

Parsing, `host`, `normalized_host` and any connection made from the URI are not affected. Only the displayed form is. Applications that show `display_uri` to users (link previews, chat and email clients, admin interfaces) can be used to make a malicious domain look like a trusted one.

- In the pure-Ruby IDNA implementation, all such characters are decoded, including those that IDNA's nameprep profile prohibits.
- In the native IDNA implementation, used when libidn and the `idn-ruby` gem are installed, libidn rejects most of them, but not characters added to Unicode after version 3.2, such as U+061C and U+2066–U+2069.

### Affected Versions

The pure-Ruby IDNA implementation is affected in Addressable >= 2.0.0. The native IDNA implementation is affected in Addressable >= 2.5.2, when `to_unicode` began accepting characters unassigned in Unicode 3.2. It is fixed in 2.9.1 for both implementations, where such labels are returned unchanged.

### Workarounds

- Install libidn and the `idn-ruby` gem, so that Addressable uses the native IDNA implementation. This reduces the affected characters to those added since Unicode 3.2.
- Check displayed hosts for bidirectional and invisible characters (e.g., `/[\p{Cc}\p{Cf}\p{Default_Ignorable_Code_Point}]/`) and fall back to `normalized_host` when one is present.

### Credits

Reported by @andrewstellman.

### For more information

If there are any questions or comments about this advisory:
* [Open an issue](https://github.com/sporkmonger/addressable/issues)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_