CVE-2020-8163

HIGH NUCLEI

Rails < 5.0.1 - Remote Code Execution via Render Locals Argument

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2020-8163. PoCs published by Lucas Amorim, lucasamorimca, h4ms1k. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit leverages a remote code execution vulnerability in Rails < 5.0.1 by injecting a command into the URL query string, which executes arbitrary shell commands via the `system` function. The payload initiates a reverse shell to a specified IP and port.

Description

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Exploits (5)

exploitdb WORKING POC
by Lucas Amorim · rubywebappsruby
https://www.exploit-db.com/exploits/48716

This exploit leverages a remote code execution vulnerability in Rails < 5.0.1 by injecting a command into the URL query string, which executes arbitrary shell commands via the `system` function. The payload initiates a reverse shell to a specified IP and port.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails < 5.0.1
No auth needed
Prerequisites: Target application running Rails < 5.0.1 · Network access to the target · Listener set up on the attacker's machine for the reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 61 stars
by lucasamorimca · poc
https://github.com/lucasamorimca/CVE-2020-8163

This repository contains a functional exploit for CVE-2020-8163, a remote code execution vulnerability in Rails < 5.0.1. The exploit leverages user-controlled `locals` in a `render` call to execute arbitrary commands via a crafted URI.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails < 5.0.1
No auth needed
Prerequisites: Vulnerable Rails application with exposed `render` call allowing user-controlled `locals`
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WORKING POC 4 stars
by h4ms1k · poc
https://github.com/h4ms1k/CVE-2020-8163

This repository contains a functional exploit for CVE-2020-8163, a blind remote code execution vulnerability in Rails versions < 5.0.1 and < 4.2.11.2. The exploit leverages user-provided local names to execute arbitrary commands via a crafted URI.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails < 5.0.1 and < 4.2.11.2
No auth needed
Prerequisites: Vulnerable Rails application · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 1 stars
by RedBinaryRabbit · poc
https://github.com/RedBinaryRabbit/CVE-2020-8163

This repository contains a functional exploit for CVE-2020-8163, a remote code execution vulnerability in Rails < 5.0.1. The exploit leverages user-provided local names to execute arbitrary commands via crafted HTTP requests.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails < 5.0.1
No auth needed
Prerequisites: Target running vulnerable Rails version · Network access to the target
devstral-2 · analyzed Feb 18, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/lucasallan/cve-2020-8163

This repository contains a functional exploit for CVE-2020-8163, a remote code execution vulnerability in Rails < 5.0.1 due to improper handling of user-provided local names in render calls. The exploit sends a crafted URI to trigger arbitrary command execution via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Ruby on Rails < 5.0.1
No auth needed
Prerequisites: Vulnerable Rails application with exposed render endpoint · Network connectivity to the target
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Nuclei Templates (1)

Ruby on Rails <5.0.1 - Remote Code Execution
HIGHby tim_koopmans
Shodan: cpe:"cpe:2.3:a:rubyonrails:rails"

References (4)

Core 4
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/304805
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html

Scores

CVSS v3 8.8
EPSS 0.9107
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-94
Status published
Products (3)
debian/debian_linux 9.0
rubygems/actionview 0 - 4.2.11.3RubyGems
rubyonrails/rails < 5.0.1
Published Jul 02, 2020
Tracked Since Feb 18, 2026