Veracode Vulnerability DatabaseVERACODE:35290Cross-site Scripting (XSS)
EPSS
Percentile
34.7%
rails is vulnerable to cross-site scripting(XSS) attacks. The library does not properly escape input data passed as hash keys for tag attributes in Action View tag helpers, allowing an attacker to inject and execute malicious javascript.
References
discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534
github.com/advisories/GHSA-ch3h-j2vf-95pv
github.com/rails/rails/commit/123f42a573f7fcbf391885c135ca809f21615180
github.com/rails/rails/commit/1278c0f0b4a18ea199f92b666b8b94954a74c20b
github.com/rails/rails/commit/36a6dad07d572a0098c29d6d96a226638a7caa38
github.com/rails/rails/commit/5c7dae5a410ff49fe4dcf30b97ee0f9148114b66
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2022-27777.yml
groups.google.com/g/ruby-security-ann/c/9wJPEDv-iRw
lists.debian.org/debian-lts-announce/2022/09/msg00002.html
rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
www.debian.org/security/2023/dsa-5372
Related
