Server-Side Request Forgery Vulnerability in Razorpay IFSC Ruby Gem

CVE-2026-110222

What is CVE-2026-110222?

The Razorpay IFSC Ruby gem, specifically versions up to 2.0.62, is affected by a server-side request forgery (SSRF) vulnerability. This issue allows attackers to manipulate API requests by providing a specially crafted IFSC code to the IFSC.find or IFSC#get methods. By submitting arbitrary network-path references or absolute URIs, attackers can direct the system to resolve these as new hosts. This could enable GET requests to be sent to either internal systems or attacker-controlled hosts, potentially exposing sensitive information or further compromising the security of the affected environment.

References