CVE-2013-6416

Rails < 4.0.1 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

References (3)

Scores

EPSS 0.0024
EPSS Percentile 46.2%

Details

CWE
CWE-79
Status published
Products (8)
rubyonrails/rails < 4.0.1
rubyonrails/rails
rubyonrails/rails
rubyonrails/rails
rubyonrails/rails
rubyonrails/rails
rubygems/actionpack < 4.0.2RubyGems
n/a/n/a
Published Dec 07, 2013
Tracked Since Feb 18, 2026