Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A…
Medium CVSS 6.1
Summary
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/rails/rails/commit/6752711c8c31d79ba50d13af6a6698a3b85415e0 Patch
- https://github.com/rails/rails/releases/tag/v8.1.2.1 Release Notes
- https://github.com/rails/rails/security/advisories/GHSA-pgm4-439c-5jp6 Vendor Advisory
Timeline
- nvd_ingest NVD