Escape Sequence Injection vulnerability in Rack #1411867 Valid No weakness recorded Medium 2023-06-28 – 2 Untrusted users able to run pending migrations in production #899069 Valid Denial of Service Medium 2020-07-24 – 3 XSS by file (Active Storage `Proxying`) #949513 Valid Cross-site Scripting Medium 2020-09-01 $500 3 Possible DOS in app with crashing `exceptions_app` #1300802 Valid Denial of Service Medium 2023-06-28 – 3 ActionController::Parameters .each returns an unsafe hash #292797 Valid No weakness recorded Medium 2020-05-18 – 4 Validation bypass for Active Record and Active Model #108723 Valid Misconfiguration and Insecure Design Medium 2016-02-12 – 5 XSS by MathML at Active Storage #429873 Duplicate Cross-site Scripting Medium 2021-06-15 – 5 ActiveStorage direct upload fails to sign content-length header for S3 service #789579 Valid Input Validation and Logic Medium 2020-05-18 – 5 The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes #732415 Valid Cross-Site Request Forgery Medium 2020-08-27 – 7 Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations) #1654310 Valid Cross-site Scripting Medium 2022-12-14 – 7 Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag #1530898 Valid Cross-site Scripting Medium 2022-06-14 – 8 Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) #1656627 Valid Cross-site Scripting Medium 2022-12-14 – 8 Missing resource identifier encoding may lead to security vulnerabilities #803922 Valid Information Disclosure Medium 2020-05-13 – 13 URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag #3727743 Valid Cross-site Scripting Medium 2026-08-24 – 13 Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability. Analysed #1955370 Valid Cross-site Scripting Medium 2023-07-28 – 15 ActionText `to_markdown` still allows `javascript:` links in kramdown via Rails-generated table cells after PR #58754 #4082665 Informative Cross-site Scripting Medium 2026-10-10 – 15 Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS Analysed #431561 Valid No weakness recorded Medium 2018-12-05 – 17 XSS vulnerability in sanitize-method when parsing link's href Analysed #328270 Valid Cross-site Scripting Medium 2018-03-22 – 18 Possible DoS in NumberHelpers Analysed #2814774 Valid Denial of Service Medium 2026-10-06 – 18 Sauce Labs API key unencrypted in an old commit #1302395 Duplicate Cryptography Medium 2024-10-08 – 23 Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown Analysed #3994016 Valid Cross-site Scripting Medium 2026-09-12 – 23 ActionView sanitize helper bypass leading to XSS using SVG tag. Analysed #1694173 Valid Cross-site Scripting Medium 2023-07-10 – 24 Regular expression denial of service in ActiveRecord's PostgreSQL Money type Analysed #1023899 Valid Denial of Service Medium 2021-02-11 – 33 Action Text XSS (Rails 7.1.x) Analysed #2389565 Valid Cross-site Scripting Medium 2025-02-04 – 33 Path Traversal on Default Installed Rails Application (Asset Pipeline) Analysed #307808 Valid File and Path Handling Medium 2018-07-19 $1,500 38 XSS vulnerabilities due to missing checks in tag helpers Analysed #1444151 Valid Cross-site Scripting Medium 2023-07-28 – 41 ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection Analysed #3580511 Valid File and Path Handling Medium 2026-05-07 – 57 1-Click Cross-Site Scripting via Custom Configuration in SafeListSanitizer #3008446 Informative Cross-site Scripting Medium 2025-04-09 – 70