Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rails | Feb 2, 2016 | Jul 26, 2015 |
| Freebsd | — | Upgrade rubygem-activesupport4Upgrade rubygem-jquery-railsUpgrade rubygem-jquery-rails4Upgrade rubygem-rails4Upgrade rubygem-rackUpgrade rubygem-railsUpgrade rubygem-rack16Upgrade rubygem-rack15Upgrade rubygem-web-consoleUpgrade rubygem-activesupport | Dec 10, 2025 | Jun 17, 2015 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jul 26, 2015 |
| Ubuntu | — | Upgrade rails | Nov 19, 2024 | Jul 26, 2015 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub