actionview

Ruby on Rails

View on Rubygems

View on Github

Activity

Latest release: 1mo ago
Total releases: 309
Cadence: ~daily
Last 12 months: 17

Reach

Stars: 58.7k

Details

License: MIT
First release: Dec 18, 2013

Releases

Version	Released
`8.0.5.1` patch	Jul 29, 2026
`7.2.3.2` patch	Jul 29, 2026
`8.1.3.1` patch	Jul 29, 2026
`8.1.3` patch	Mar 24, 2026
`8.0.5` patch	Mar 24, 2026
`8.1.2.1` patch	Mar 23, 2026
`8.0.4.1` patch	Mar 23, 2026
`7.2.3.1` patch	Mar 23, 2026
`8.1.2` patch 1 CVE	Jan 08, 2026
`8.1.1` patch 1 CVE	Oct 28, 2025
`8.0.4` patch 1 CVE	Oct 28, 2025
`7.2.3` patch 1 CVE	Oct 28, 2025
`7.1.6` patch 1 CVE	Oct 28, 2025
`7.0.10` patch 1 CVE	Oct 28, 2025
`7.0.9` patch 1 CVE	Oct 28, 2025
`8.1.0` minor 1 CVE	Oct 22, 2025
`8.1.0.rc1` pre 1 CVE	Oct 15, 2025
`8.0.3` patch 1 CVE	Sep 22, 2025
`8.1.0.beta1` pre 1 CVE	Sep 04, 2025
`8.0.2.1` patch 1 CVE	Aug 13, 2025
`7.2.2.2` patch 1 CVE	Aug 13, 2025
`7.1.5.2` patch 1 CVE	Aug 13, 2025
`8.0.2` patch 1 CVE	Mar 12, 2025
`8.0.1` patch 1 CVE	Dec 13, 2024
`7.0.8.7` patch 1 CVE	Dec 10, 2024
`7.1.5.1` patch 1 CVE	Dec 10, 2024
`8.0.0.1` patch 1 CVE	Dec 10, 2024
`7.2.2.1` patch 1 CVE	Dec 10, 2024
`8.0.0` major 1 CVE	Nov 07, 2024
`7.1.5` patch 1 CVE	Oct 31, 2024
`7.2.2` patch 1 CVE	Oct 31, 2024
`8.0.0.rc2` pre 1 CVE	Oct 30, 2024
`7.2.1.2` patch 1 CVE	Oct 23, 2024
`7.0.8.6` patch 1 CVE	Oct 23, 2024
`7.1.4.2` patch 1 CVE	Oct 23, 2024
`6.1.7.10` patch 1 CVE	Oct 23, 2024
`8.0.0.rc1` pre 1 CVE	Oct 19, 2024
`7.2.1.1` patch 1 CVE	Oct 15, 2024
`7.0.8.5` patch 1 CVE	Oct 15, 2024
`7.1.4.1` patch 1 CVE	Oct 15, 2024
`6.1.7.9` patch 1 CVE	Oct 15, 2024
`8.0.0.beta1` pre 1 CVE	Sep 26, 2024
`7.2.1` patch 1 CVE	Aug 22, 2024
`7.1.4` patch 1 CVE	Aug 22, 2024
`7.2.0` minor 1 CVE	Aug 09, 2024
`7.2.0.rc1` pre 1 CVE	Aug 06, 2024
`7.2.0.beta3` pre 1 CVE	Jul 11, 2024
`7.2.0.beta2` pre 1 CVE	Jun 04, 2024
`7.0.8.4` patch 1 CVE	Jun 04, 2024
`7.1.3.4` patch 1 CVE	Jun 04, 2024

1–50 of 309

Repository

rails/rails

Forks: 22.3k
Open issues: 487
Language: Ruby
: 6.0/ 10

rails
mvc
html
activerecord
activejob
ruby

Dependencies (7)

Depends on

8.0.5.1

Used by

477

Supply-chain exposure

477 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (13)

CVE-2026-33168 GHSA-v55j-83pf-r9cq Mar 23, 2026

Rails has a possible XSS vulnerability in its Action View tag helpers

Low
Network Low None

Impact

When a blank string is used as an HTML attribute name in Action View tag helpers, the attribute escaping is bypassed, producing malformed HTML. A carefully crafted attribute value could then be misinterpreted by the browser as a separate attribute name, possibly leading to XSS. Applications that allow users to specify custom HTML attributes are affected.

Releases

The fixed releases are available at the normal locations.

Credit

This issue was responsibly reported by Hackerone researcher taise.

Affected versions

8.1.08.1.0.beta18.1.0.rc18.1.18.1.28.0.08.0.0.18.0.0.beta18.0.0.rc18.0.0.rc28.0.18.0.2

+ 289 more Show less

8.0.2.18.0.38.0.44.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.106.1.7.26.1.7.36.1.7.46.1.7.56.1.7.66.1.7.76.1.7.86.1.7.97.0.07.0.0.alpha17.0.0.alpha27.0.0.rc17.0.0.rc27.0.0.rc37.0.17.0.107.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.77.0.7.17.0.7.27.0.87.0.8.17.0.8.27.0.8.37.0.8.47.0.8.57.0.8.67.0.8.77.0.97.1.07.1.0.beta17.1.0.rc17.1.0.rc27.1.17.1.27.1.37.1.3.17.1.3.27.1.3.37.1.3.47.1.47.1.4.17.1.4.27.1.57.1.5.17.1.5.27.1.67.2.07.2.0.beta17.2.0.beta27.2.0.beta37.2.0.rc17.2.17.2.1.17.2.1.27.2.27.2.2.17.2.2.27.2.3

Fixed in

7.2.3.18.0.4.18.1.2.1

References

https://github.com/rails/rails/security/advisories/GHSA-v55j-83pf-r9cq
https://nvd.nist.gov/vuln/detail/CVE-2026-33168
https://github.com/rails/rails/commit/0b6f8002b52b9c606fd6be9e7915d9f944cf539c
https://github.com/rails/rails/commit/63f5ad83edaa0b976f82d46988d745426aa4a42d
https://github.com/rails/rails/commit/c79a07df1e88738df8f68cb0ee759ad6128ca924
https://github.com/rails/rails

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2023-23913 GHSA-xp5h-f8jf-rc8q Jun 09, 2023

rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

6.3 / 10
Medium
Network Low None Required Unchanged Low Low Low

NOTE: rails-ujs is part of Rails/actionview since 5.1.0.

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

This vulnerability has been assigned the CVE identifier CVE-2023-23913.

Not affected: < 5.1.0 Versions Affected: >= 5.1.0 Fixed Versions: 6.1.7.3, 7.0.4.3

Impact If the specified malicious HTML clipboard content is provided to a contenteditable element, this could result in the arbitrary execution of javascript on the origin in question.

Releases The FIXED releases are available at the normal locations.

Workarounds We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can attempt to mitigate this vulnerability by removing the contenteditable attribute from elements in pages that rails-ujs will interact with.

Patches To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series

rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities.

Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits We would like to thank ryotak 15 for reporting this!

rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)

rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)

rails-ujs-data-method-contenteditable-main.patch (8.9 KB)

Affected versions

5.1.05.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc1

+ 106 more Show less

5.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.0.4.86.0.56.0.5.16.0.66.0.6.16.1.06.1.0.rc16.1.0.rc26.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.56.1.5.16.1.66.1.6.16.1.76.1.7.16.1.7.27.0.07.0.17.0.27.0.2.17.0.2.27.0.2.37.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.2

Fixed in

6.1.7.37.0.4.3

References

https://nvd.nist.gov/vuln/detail/CVE-2023-23913
https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd
https://github.com/rails/rails/commit/73009ea59a811b28e8ec2a9c9bc24635aa891214
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263
https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468
https://github.com/rails/rails

Updated Jan 09, 2025 · Source: OSV.dev
CVE-2022-27777 GHSA-ch3h-j2vf-95pv Apr 27, 2022

XSS Vulnerability in Action View tag helpers

6.1 / 10
Medium
Network Low None Required Changed Low Low None

There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

Escape the untrusted data before using it as a key for tag helper methods.

Affected versions

4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.11

+ 187 more Show less

4.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.76.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.26.0.4.36.0.4.46.0.4.56.0.4.66.0.4.76.1.06.1.16.1.26.1.2.16.1.36.1.3.16.1.3.26.1.46.1.4.16.1.4.26.1.4.36.1.4.46.1.4.56.1.4.66.1.4.76.1.57.0.07.0.17.0.27.0.2.17.0.2.27.0.2.3

Fixed in

5.2.7.16.0.4.86.1.5.17.0.2.4

References

https://nvd.nist.gov/vuln/detail/CVE-2022-27777
https://github.com/rails/rails/commit/649516ce0feb699ae06a8c5e81df75d460cc9a85
https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
https://groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2020-15169 GHSA-cfjv-5498-mph5 Sep 11, 2020

XSS in Action View

5.4 / 10
Medium
Network High None None Changed Low Low None

There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks.

Impact

When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:

<%# The welcome_html translation is not defined for the current locale: %> <%= t("welcome_html", default: untrusted_user_controlled_string) %> <%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %> <%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>

Patches

Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.

The patches have also been applied to the master, 6-0-stable, and 5-2-stable branches on GitHub. If you track any of these branches, you should update to the latest.

To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

5-2-translate-helper-xss.patch — patch for the 5.2 release series

6-0-translate-helper-xss.patch — patch for the 6.0 release series

Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.

Workarounds

Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the html_escape helper (aliased as h):

<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>

Affected versions

4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.11

+ 143 more Show less

4.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.rc16.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.rc1

Fixed in

5.2.4.46.0.3.3

References

https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5
https://nvd.nist.gov/vuln/detail/CVE-2020-15169
https://github.com/rails/rails/commit/e663f084460ea56c55c3dc76f78c7caeddeeb02e
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-15169.yml
https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2020-8163 GHSA-cr3x-7m39-c6jq BIT-rails-2020-8163 Jul 07, 2020

Remote code execution via user-provided local names in ActionView

8.8 / 10
High
Network Low Low None Unchanged High High High

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE.

Affected versions

4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.11

+ 66 more Show less

4.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc2

Fixed in

4.2.11.3

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8163
https://hackerone.com/reports/304805
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2020-8167 GHSA-xq5j-gw7f-jgj8 Jul 07, 2020

CSRF Vulnerability in rails-ujs

6.5 / 10
Medium
Network Low None Required Unchanged None High None

There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.

Versions Affected: rails <= 6.0.3 Not affected: Applications which don't use rails-ujs. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds

To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

link_to params

to code like this:

link_to filtered_params def filtered_params # Filter just the parameters that you trust end

Affected versions

5.0.05.0.0.15.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc1

+ 53 more Show less

5.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.rc16.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.rc1

Fixed in

5.2.4.36.0.3.1

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8167
https://hackerone.com/reports/189878
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8167.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0
https://www.debian.org/security/2020/dsa-4766

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2020-5267 GHSA-65cv-r6x7-79hv Mar 19, 2020

Cross site scripting vulnerability in ActionView

4.8 / 10
Medium
Network Low High Required Changed Low Low None

There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escape_javascript methods may be susceptible to XSS attacks.

Impact

There is a possible XSS vulnerability in the j and escape_javascript methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:

<script>let a = `<%= j unknown_input %>`</script>

or

<script>let a = `<%= escape_javascript unknown_input %>`</script>

Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

Workarounds

For those that can't upgrade, the following monkey patch may be used:

ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!( { "`" => "\\`", "$" => "\\$" } ) module ActionView::Helpers::JavaScriptHelper alias :old_ej :escape_javascript alias :old_j :j def escape_javascript(javascript) javascript = javascript.to_s if javascript.empty? result = "" else result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP) end javascript.html_safe? ? result.html_safe : result end alias :j :escape_javascript end

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

5-2-js-helper-xss.patch - Patch for 5.2 series

6-0-js-helper-xss.patch - Patch for 6.0 series

Please note that only the 5.2 and 6.0 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits

Thanks to Jesse Campos from Chef Secure

Affected versions

4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.11

+ 136 more Show less

4.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.11.14.2.11.24.2.11.34.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.0.05.0.0.15.0.0.beta15.0.0.beta1.15.0.0.beta25.0.0.beta35.0.0.beta45.0.0.racecar15.0.0.rc15.0.0.rc25.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.15.0.7.25.1.05.1.0.beta15.1.0.rc15.1.0.rc25.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.1.6.25.1.75.1.7.rc15.2.05.2.0.beta15.2.0.beta25.2.0.rc15.2.0.rc25.2.15.2.1.15.2.1.rc15.2.25.2.2.15.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.rc16.0.06.0.16.0.1.rc16.0.26.0.2.16.0.2.rc16.0.2.rc2

Fixed in

5.2.4.26.0.2.2

References

https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv
https://nvd.nist.gov/vuln/detail/CVE-2020-5267
https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-5267.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8
https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html

Updated Jul 08, 2026 · Source: OSV.dev
CVE-2019-5418 GHSA-86g5-2wh3-gc9j Mar 13, 2019

Path Traversal in Action View

7.5 / 10
High
Network Low None None Unchanged High None None

File Content Disclosure in Action View

Impact

There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to render file: can cause arbitrary files on the target server to be rendered, disclosing the file contents.

The impact is limited to calls to render which render file contents without a specified accept format. Impacted code in a controller looks something like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file" end end

Rendering templates as opposed to files is not impacted by this vulnerability.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds

This vulnerability can be mitigated by specifying a format for file rendering, like this:

class UserController < ApplicationController def index render file: "#{Rails.root}/some/file", formats: [:html] end end

In summary, impacted calls to render look like this:

render file: "#{Rails.root}/some/file"

The vulnerability can be mitigated by changing to this:

render file: "#{Rails.root}/some/file", formats: [:html]

Other calls to render are not impacted.

Alternatively, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end)

Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

Affected versions

5.2.05.2.15.2.1.15.2.1.rc15.2.25.2.2.rc14.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.1

+ 101 more Show less

4.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.1.05.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.0.05.0.0.15.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.1

Fixed in

4.2.11.15.0.7.25.1.6.25.2.2.1

References

https://nvd.nist.gov/vuln/detail/CVE-2019-5418
https://access.redhat.com/errata/RHSA-2019:0796
https://access.redhat.com/errata/RHSA-2019:1147
https://access.redhat.com/errata/RHSA-2019:1149
https://access.redhat.com/errata/RHSA-2019:1289
https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q

Updated Oct 22, 2025 · Source: OSV.dev
CVE-2019-5419 GHSA-m63j-wh5w-c252 Mar 13, 2019

Denial of Service Vulnerability in Action View

7.5 / 10
High
Network Low None None Unchanged None None High

Denial of Service Vulnerability in Action View

Impact

Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests. This impacts all Rails applications that render views.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations.

Workarounds

This vulnerability can be mitigated by wrapping render calls with respond_to blocks. For example, the following example is vulnerable:

class UserController < ApplicationController def index render "index" end end

But the following code is not vulnerable:

class UserController < ApplicationController def index respond_to |format| format.html { render "index" } end end end

Implicit rendering is impacted, so this code is vulnerable:

class UserController < ApplicationController def index end end

But can be changed this this:

class UserController < ApplicationController def index respond_to |format| format.html { render "index" } end end end

Alternatively to specifying the format, the following monkey patch can be applied in an initializer:

$ cat config/initializers/formats_filter.rb # frozen_string_literal: true ActionDispatch::Request.prepend(Module.new do def formats super().select do |format| format.symbol || format.ref == "*/*" end end end)

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Also note that the patches for this vulnerability are the same as CVE-2019-5418.

Credits

Thanks to John Hawthorn john@hawthorn.email of GitHub

Affected versions

4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc24.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.11

+ 103 more Show less

4.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc44.2.104.2.10.rc14.2.114.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc25.2.05.2.15.2.1.15.2.1.rc15.2.25.2.2.rc15.1.05.1.15.1.25.1.2.rc15.1.35.1.3.rc15.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.65.1.6.15.0.05.0.0.15.0.15.0.1.rc15.0.1.rc25.0.25.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.75.0.7.16.0.0.beta16.0.0.beta2

Fixed in

4.2.11.15.0.7.25.1.6.25.2.2.16.0.0.beta3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-5419
https://github.com/rails/rails/pull/35708
https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715
https://access.redhat.com/errata/RHSA-2019:0796
https://access.redhat.com/errata/RHSA-2019:1147
https://access.redhat.com/errata/RHSA-2019:1149

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2011-0446 GHSA-75w6-p6mg-vh8j Oct 24, 2017

Rails actionpack gem vulnerable to Cross-site Scripting

Medium

Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

Fixed in

2.3.113.0.4

References

https://nvd.nist.gov/vuln/detail/CVE-2011-0446
https://github.com/rails/rails/commit/abe97736b8316f1b714cac56c115c0779aa73217
https://github.com/rails/rails/commit/e3dd2107c57a8efaaea5d61cf8da65f7444760b2
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-0446.yml
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml

Updated Nov 28, 2024 · Source: OSV.dev

1–10 of 13

Insights

Releases per month

last 12 months

Release mix

major 4
minor 7
patch 195
pre 102

309 releases

Dependencies over time

per release

Minimum runtime

over time

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More