| Package | Affected versions | Patched versions |
|---|---|---|
| activesupport | ≥ 8.0.0.beta1, < 8.0.4.1≥ 8.1.0.beta1, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
| rails | ≥ 8.0.0, < 8.0.4.1≥ 8.1.0, < 8.1.2.1< 7.2.3.1 | 8.0.4.18.1.2.17.2.3.1 |
SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g. via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.
The fixed releases are available at the normal locations.
This issue was responsibly reported by @ch4n3-yoon
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free