Skip to content
BackEsc
Sign in

Ruby on Rails · disclosed reports

Cross-site Scripting

22 disclosed reports · $500 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Ruby on Rails on HackerOne
reports
22
paid a bounty
1

Every one of the 22 is a mark on the map. Named now: 1 to 22, most upvoted first.

  1. 1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizer#3008446Ruby on Rails · 70 votes
  2. XSS when using `translate` in Action Controller (Rails 7.0, 7.1)#2303609Ruby on Rails · 50 votes
  3. XSS vulnerabilities due to missing checks in tag helpers#1444151Ruby on Rails · 41 votes
  4. Action Text XSS (Rails 7.1.x)#2389565Ruby on Rails · 33 votes
  5. ActionView sanitize helper bypass leading to XSS using SVG tag.#1694173Ruby on Rails · 24 votes
  6. Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown#3994016Ruby on Rails · 23 votes
  7. Content Security Policy is only active for HTML responses but not for image/svg+xml#1327196Ruby on Rails · 20 votes
  8. XSS vulnerability in sanitize-method when parsing link's href#328270Ruby on Rails · 18 votes
  9. ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754#4082665Ruby on Rails · 15 votes
  10. Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability.#1955370Ruby on Rails · 15 votes
  11. URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag#3727743Ruby on Rails · 13 votes
  12. XSS due to incomplete JS escaping#474262Ruby on Rails · 13 votes
  13. Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style)#1656627Ruby on Rails · 8 votes
  14. Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag#1530898Ruby on Rails · 8 votes
  15. JSON keys are not properly escaped#47280Ruby on Rails · 8 votes
  16. Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations)#1654310Ruby on Rails · 7 votes
  17. Data-Tags and the New HTML Sanitizer Subverts CSRF protection#42728Ruby on Rails · 6 votes
  18. XSS by MathML at Active Storage#429873Ruby on Rails · 5 votes
  19. Potential XSS on sanitize/Rails::Html::WhiteListSanitizer#81212Ruby on Rails · 5 votes
  20. XSS by file (Active Storage `Proxying`)#949513Ruby on Rails · $500 · 3 votes
  21. [Rails42] We can inject HTML tags when server is using strip_tags method#81396Ruby on Rails · 3 votes
  22. Prevent XSS when passing a parameter directly into link_to#755354Ruby on Rails · 2 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in