Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rails | Feb 2, 2016 | Jul 26, 2015 |
| Freebsd | — | Upgrade rubygem-jquery-railsUpgrade rubygem-rackUpgrade rubygem-activesupport4Upgrade rubygem-jquery-rails4Upgrade rubygem-rails4Upgrade rubygem-rack16Upgrade rubygem-railsUpgrade rubygem-rack15Upgrade rubygem-activesupportUpgrade rubygem-web-console | Dec 10, 2025 | Jun 17, 2015 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jul 26, 2015 |
| Ubuntu | — | Upgrade rails | Nov 19, 2024 | Jul 26, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub