actionpack Cross-site Scripting vulnerability

MEDIUM 4.3CVE-2013-6416 · GHSA-w37c-q653-qg95 · Published 07/12/2013 · updated 17/06/2026

Package	Affected versions	Patched versions
actionpack RubyGems	`≥ 4.0.0, < 4.0.2`	`4.0.2`
rails rubyonrails	`= 4.0.0= 4.0.1≤ 4.0.1`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

NVD description

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

References

nvd.nist.gov/vuln/detail/CVE-2013-6416 · ADVISORY
rails/rails commit 4b4f584 · WEB
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
groups.google.com/forum · WEB
groups.google.com/forum/message/raw · WEB
web.archive.org/web/20200228165109/http://www.securityfocus.com/bid/64071 · WEB
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released · WEB
weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released
securityfocus.com/bid/64071

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free