GitHub Advisoryadvisory · RubyGems

GHSA-vxvp-4xwc-jpp6 activesupport Cross-site Scripting vulnerability

MEDIUM Published 2017-10-24 Modified 2025-11-04 Official page ↗
Aliases
CVE-2015-3226
Ecosystem
RubyGems
Packages
activesupport
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems activesupport: >= 4.1.0, < 4.1.11 → fixed in 4.1.11 • RubyGems activesupport: >= 4.2.0, < 4.2.2 → fixed in 4.2.2

Description

Cross-site scripting (XSS) vulnerability in `json/encoding.rb` in Active Support in Ruby on Rails 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.

Related

Alias · CVE (1)

  • CVE-2015-3226 Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References