[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fn5X7souErn_r__w_yQbuJJz5OP_GGhHrvtItwGgc28Q":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":86,"kevVulnerabilities":148,"topProductsByCves":161,"seoMetadata":172,"meta":181},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":85},27544,"rubyonrails",15,137,3,524,"2024-12-02","r",[16,22,29,34,40,46,50,55,58,61,65,69,73,76,81],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},139771,"rails",287,113,"2024-06-04",{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":28},139773,"ruby_on_rails",176,50,0,"2017-12-29",{"id":30,"product_name":31,"version_count":32,"cve_count":33,"kev_count":27,"last_cve_update":13},139772,"rails_html_sanitizers",14,10,{"id":35,"product_name":36,"version_count":37,"cve_count":38,"kev_count":27,"last_cve_update":39},139768,"html_sanitizer",5,4,"2018-03-30",{"id":41,"product_name":42,"version_count":43,"cve_count":44,"kev_count":27,"last_cve_update":45},139761,"actionpack_page-caching",8,2,"2021-05-27",{"id":47,"product_name":48,"version_count":27,"cve_count":44,"kev_count":27,"last_cve_update":49},139760,"actionpack","2022-05-26",{"id":51,"product_name":52,"version_count":11,"cve_count":53,"kev_count":27,"last_cve_update":54},139769,"jquery-rails",1,"2015-07-26",{"id":56,"product_name":57,"version_count":53,"cve_count":53,"kev_count":27,"last_cve_update":54},139770,"jquery-ujs",{"id":59,"product_name":60,"version_count":53,"cve_count":53,"kev_count":27,"last_cve_update":54},139774,"web_console",{"id":62,"product_name":63,"version_count":11,"cve_count":53,"kev_count":27,"last_cve_update":64},139762,"actionview","2020-03-19",{"id":66,"product_name":67,"version_count":27,"cve_count":53,"kev_count":27,"last_cve_update":68},139764,"active_record_session_store","2021-03-05",{"id":70,"product_name":71,"version_count":37,"cve_count":53,"kev_count":27,"last_cve_update":72},139765,"active_resource","2020-05-12",{"id":74,"product_name":75,"version_count":27,"cve_count":53,"kev_count":27,"last_cve_update":49},139766,"active_storage",{"id":77,"product_name":78,"version_count":79,"cve_count":53,"kev_count":27,"last_cve_update":80},139767,"globalid",21,"2023-02-09",{"id":82,"product_name":83,"version_count":27,"cve_count":27,"kev_count":27,"last_cve_update":84},139763,"active_job",null,"Rubyonrails is a technology vendor with 15 tracked products and 137 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[87,96,102,107,112,118,125,131,138,143],{"cveId":88,"description":89,"publishedDate":90,"cvssScore":91,"cvssVersion":92,"severity":93,"isKev":94,"epssScore":95},"CVE-2013-0156","active_support\u002Fcore_ext\u002Fhash\u002Fconversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.","2013-01-13",7.5,"v2","High",false,0.99449,{"cveId":97,"description":98,"publishedDate":99,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":101},"CVE-2019-5418","There is a File Content Disclosure vulnerability in Action View \u003C5.2.2.1, \u003C5.1.6.2, \u003C5.0.7.2, \u003C4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.","2019-03-27","v3.1",0.98507,{"cveId":103,"description":104,"publishedDate":105,"cvssScore":91,"cvssVersion":92,"severity":93,"isKev":94,"epssScore":106},"CVE-2013-0333","lib\u002Factive_support\u002Fjson\u002Fbackends\u002Fyaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.","2013-01-30",0.95573,{"cveId":108,"description":109,"publishedDate":110,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":111},"CVE-2016-0752","Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.","2016-02-16",0.95537,{"cveId":113,"description":114,"publishedDate":99,"cvssScore":115,"cvssVersion":100,"severity":116,"isKev":94,"epssScore":117},"CVE-2019-5420","A remote code execution vulnerability in development mode Rails \u003C5.2.2.1, \u003C6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.",9.8,"Critical",0.8933,{"cveId":119,"description":120,"publishedDate":121,"cvssScore":122,"cvssVersion":100,"severity":123,"isKev":94,"epssScore":124},"CVE-2021-22881","The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.","2021-02-11",6.1,"Medium",0.87301,{"cveId":126,"description":127,"publishedDate":128,"cvssScore":129,"cvssVersion":100,"severity":93,"isKev":94,"epssScore":130},"CVE-2020-8163","The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","2020-07-02",8.8,0.82047,{"cveId":132,"description":133,"publishedDate":134,"cvssScore":135,"cvssVersion":136,"severity":93,"isKev":94,"epssScore":137},"CVE-2016-2098","Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","2016-04-07",7.3,"v3.0",0.81445,{"cveId":139,"description":140,"publishedDate":141,"cvssScore":122,"cvssVersion":100,"severity":123,"isKev":94,"epssScore":142},"CVE-2020-8264","In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.","2021-01-06",0.66986,{"cveId":144,"description":145,"publishedDate":146,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":147},"CVE-2014-0130","Directory traversal vulnerability in actionpack\u002Flib\u002Fabstract_controller\u002Fbase.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.","2014-05-07",0.53703,[149,154,159],{"cveId":97,"description":98,"publishedDate":99,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":101,"cisaVulnName":150,"cisaDateAdded":151,"cisaShortDescription":152,"cisaRequiredAction":153},"Rails Ruby on Rails Path Traversal Vulnerability","2025-07-07","Rails Ruby on Rails contains a path traversal vulnerability in Action View. Specially crafted accept headers in combination with calls to `render file:` can cause arbitrary files on the target server to be rendered, disclosing the file contents.","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",{"cveId":144,"description":145,"publishedDate":146,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":147,"cisaVulnName":155,"cisaDateAdded":156,"cisaShortDescription":157,"cisaRequiredAction":158},"Ruby on Rails Directory Traversal Vulnerability","2022-03-25","Directory traversal vulnerability in actionpack\u002Flib\u002Fabstract_controller\u002Fbase.rb in the implicit-render implementation in Ruby on Rails allows remote attackers to read arbitrary files via a crafted request.","Apply updates per vendor instructions.",{"cveId":108,"description":109,"publishedDate":110,"cvssScore":91,"cvssVersion":100,"severity":93,"isKev":4,"epssScore":111,"cisaVulnName":155,"cisaDateAdded":156,"cisaShortDescription":160,"cisaRequiredAction":158},"Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.",[162,163,164,165,166,167,168,169,170,171],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":11,"last_cve_update":21},{"id":23,"product_name":24,"version_count":25,"cve_count":26,"kev_count":27,"last_cve_update":28},{"id":30,"product_name":31,"version_count":32,"cve_count":33,"kev_count":27,"last_cve_update":13},{"id":35,"product_name":36,"version_count":37,"cve_count":38,"kev_count":27,"last_cve_update":39},{"id":41,"product_name":42,"version_count":43,"cve_count":44,"kev_count":27,"last_cve_update":45},{"id":47,"product_name":48,"version_count":27,"cve_count":44,"kev_count":27,"last_cve_update":49},{"id":51,"product_name":52,"version_count":11,"cve_count":53,"kev_count":27,"last_cve_update":54},{"id":56,"product_name":57,"version_count":53,"cve_count":53,"kev_count":27,"last_cve_update":54},{"id":59,"product_name":60,"version_count":53,"cve_count":53,"kev_count":27,"last_cve_update":54},{"id":62,"product_name":63,"version_count":11,"cve_count":53,"kev_count":27,"last_cve_update":64},{"title":173,"metaDescription":174,"keywords":175,"structuredData":176},"Rubyonrails - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Rubyonrails covering 15 products with 137 tracked vulnerabilities including 0 critical and 3 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Rubyonrails vulnerabilities, Rubyonrails security, Rubyonrails CVE, Rubyonrails threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Rubyonrails KEV, Rubyonrails exploited vulnerabilities",{"@context":177,"@type":178,"name":179,"description":174,"url":180},"https:\u002F\u002Fschema.org","Organization","Rubyonrails","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Frubyonrails",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":182,"apiVersion":183},"2026-10-17T16:57:13.659Z","3.0"]