CVE-2015-3226
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
- EPSS
- 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:rails
- rubyonrails:ruby_on_rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-vxvp-4xwc-jpp6 | RubyGems | activesupport | >=4.1.0 <4.1.11 | 4.1.11 |
| GHSA-vxvp-4xwc-jpp6 | RubyGems | activesupport | >=4.2.0 <4.2.2 | 4.2.2 |