CVE-2026-73426 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby4.0-rails, ruby3.3-rails, ruby3.4-rails...

The vulnerability of the ActionView component of the Ruby on Rails software platform allows attackers to execute arbitrary code.

The vulnerability of the ActionView component of the Ruby on Rails software platform is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20260506-73-0040

Vulnerability in rubygem-actionview due to failure to take measures to protect web page structure. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...

Cross-site Scripting (XSS)

Overview actionview is a simple, battle-tested conventions and helpers for building web pages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via custom HTML attributes passed in to tag helpers. An attacker can inject scripts that may be executed in the context of th...

OPENSUSE-SU-2026:10340-1 ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-actionview-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed...

EUVD-2017-0269

Malware in sbrugna...

EUVD-2020-0332

Malware in sbrugna...

Internet Bug Bounty: #2931639 ActionView sanitize helper bypass with math-related tags

There is a vulnerability in Rails-HTML-Sanitizer 1.6.0, which is also used by Rails ActionView. The vulnerability allows for bypassing the sanitization process when certain math-related tags, such as "math", "mtext", "table", "style", and "mglyph" or "malignmark", are allowed. This could lead to...

Internet Bug Bounty: ActionView sanitize helper bypass with style and math

The Rails-html-sanitizer version 1.6.0 was affected by a vulnerability that could lead to a bypass of the sanitization process, resulting in potential cross-site scripting XSS attacks. The vulnerability was addressed in version 1.6.1...

Internet Bug Bounty: ActionView sanitize helper bypass with 'style' and 'svg' tags

The Rails-html-sanitizer, which Rails ActionView also uses, failed to sanitize input when svg and style or math and style tags were allowed. This resulted in a potential XSS vulnerability in applications that used the sanitize helper...

RHEL 6 / 7 : rh-ror41 (RHSA-2016:0456)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0456 advisory. The rh-ror41 collection provides Ruby on Rails version 4.1. Ruby on Rails is a model-view-controller MVC framework for web application...

RHSA-2016:1856 Red Hat Security Advisory: rh-ror41-rubygem-actionview security update

Bulletin has no description...

OESA-2024-1776 rubygem-actionview security update

Simple, battle-tested conventions and helpers for building web pages. Security Fixes: A flaw was found in Rails. rails-ujs may allow an attacker to perform Cross-Site Scripting XSS, which could lead to stolen information, phishing attacks, and other types of attacks.CVE-2023-23913...

OESA-2024-1775 rubygem-actionview security update

Simple, battle-tested conventions and helpers for building web pages. Security Fixes: A flaw was found in Rails. rails-ujs may allow an attacker to perform Cross-Site Scripting XSS, which could lead to stolen information, phishing attacks, and other types of attacks.CVE-2023-23913...

OESA-2024-1774 rubygem-actionview security update

Simple, battle-tested conventions and helpers for building web pages. Security Fixes: A flaw was found in Rails. rails-ujs may allow an attacker to perform Cross-Site Scripting XSS, which could lead to stolen information, phishing attacks, and other types of attacks.CVE-2023-23913...

MAL-2024-6388 Malicious code in actionview-link-to_block (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in actionview-link-to_block (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6387 Malicious code in actionview-link-to_blank (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in actionview-link-to_blank (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

OPENSUSE-SU-2024:10057-1 ruby2.2-rubygem-actionview-4_2-4.2.7.1-1.1 on GA media

These are all security issues fixed in the ruby2.2-rubygem-actionview-42-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed...