CVE-2009-4214
rubyonrails: no CVSS score yet. EPSS 3.0% chance of exploitation in the next 30 days. Fixed in rails 2.2.2, 2.3.5.
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
- rubyonrails:ruby_on_rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9p3v-wf2w-v29c | RubyGems | rails | <2.2.2 | 2.2.2 |
| GHSA-9p3v-wf2w-v29c | RubyGems | rails | >=2.3.0 <2.3.5 | 2.3.5 |
References
- http://github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
- http://secunia.com/advisories/37446