https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T13:50:56.769855+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2022-27777 CVE-2022-27777 2026-10-08T13:50:56.800963+00:00

Affected: https://github.com/rails/rails

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

 https://cve.radiocsirt.org/vuln/ghsa-ch3h-j2vf-95pv GHSA-ch3h-j2vf-95pv — XSS Vulnerability in Action View tag helpers 2026-10-08T13:50:56.801021+00:00

Affected: RubyGems: actionview

There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

``` check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' }) ```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.