Cross Site Scripting (XSS)

resque is vulnerable to Reflected Cross Site Scripting (XSS). The vulnerability is caused due to not sanitizing and escaping HTML while displaying failed queue lists related web pages of the resque-web component. An attacker can make a user click on a malicious link leading to Reflected XSS when the failed or queue related web pages (/views/failed.erb , /views/queues.erb , /views/failed.erb and /views/key_string.erb) are displayed on the browser.