CVE-2020-15169

MEDIUM

Action View < 5.2.4.4 - Cross-Site Scripting in Translation Helpers

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2020-15169. PoCs published by glasses618.

AI-analyzed exploit summary This repository appears to be a stub or placeholder for a Rails application demonstrating CVE-2020-15169 but lacks actual exploit code or PoC implementation. The codebase is a standard Rails 6.0 scaffold with no offensive techniques or vulnerability-specific logic.

Description

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Exploits (1)

nomisec STUB
by glasses618 · poc
https://github.com/glasses618/CVE-2020-15169

This repository appears to be a stub or placeholder for a Rails application demonstrating CVE-2020-15169 but lacks actual exploit code or PoC implementation. The codebase is a standard Rails 6.0 scaffold with no offensive techniques or vulnerability-specific logic.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Rails applications with vulnerable Action Pack (CVE-2020-15169)
No auth needed
Prerequisites: A Rails application vulnerable to CVE-2020-15169
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (4)

Core 4
Core References
Patch, Third Party Advisory x_refsource_confirm
https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2020/dsa-4766
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/10/msg00015.html

Scores

CVSS v3 5.4
EPSS 0.0118
EPSS Percentile 79.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (4)
action_view_project/action_view < 5.2.4.4
debian/debian_linux 10.0
fedoraproject/fedora 33
rubygems/actionview 0 - 5.2.4.4RubyGems
Published Sep 11, 2020
Tracked Since Feb 18, 2026