CVE-2026-110222: Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup
Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host, sending GET requests to internal or attacker-chosen hosts and returning parsed response fields.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using the Razorpay IFSC Ruby gem through version 2.0.62 are exposed when an attacker can influence the IFSC value passed to IFSC.find or IFSC#get.
What does an attacker need to provide to exploit it?
The attacker must supply a crafted IFSC code containing a network-path reference or an absolute URI. URI.join can then resolve the value to a different host.
What is the impact of a successful request redirection?
The gem can send a GET request to an internal host or an attacker-selected host. Parsed fields from that response are returned to the caller.
How can I identify potentially affected deployments?
Check for the rubygems/razorpay-ifsc dependency at version 2.0.62 or earlier, and identify code paths that pass externally controlled IFSC values to IFSC.find or IFSC#get.