Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision

[santiagodoldan]

Looks like a Sinatra vulnerability was reported here GHSA-hxx2-7vcw-mqr3.

[gravitystorm]

A new version of sinatra, 4.1.0, has now been released and that version fixes this CVE.

sinatra/sinatra@73f3291

However, mailcatcher depends on "sinatra", "~> 3.2". It would be great if the dependency on sinatra is relaxed, to pick up the sinatra 4.x series too.

[tbone587]

Just came across this. Would be nice to get rid of the sinatra cve!