Most recent entries from all

certfr-2026-avi-0349 — De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à u…

certfr-2026-avi-0349

EUVD-2026-277266

fkie_cve-2026-33167

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

GHSA-pgm4-439c-5jp6 — Rails has a possible XSS vulnerability in its Action Pack debug exceptions

Affected: RubyGems: actionpack

### Impact The debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development.

### Releases The fixed releases are available at the normal locations.

### Credit This issue was responsibly reported by Hackerone researcher [fbettag](https://hackerone.com/fbettag).

UBUNTU-CVE-2026-33167

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2026-0833 — Ruby on Rails: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, um Dateien zu manipulieren, und um einen Cross-Site Scripting Angriff durchzuführen.