Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
ActiveStorage Disk Service Path Traversal via Custom Blob Key InjectionAnalysed#3580511	Valid	File and Path Handling	Medium	2026-05-07	–	57
XSS when using `translate` in Action Controller (Rails 7.0, 7.1)Analysed#2303609	Valid	Cross-site Scripting	Low	2024-10-01	–	50
Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookiesAnalysed#895727	Valid	Input Validation and Logic	Low	2020-06-16	–	46
Action Text XSS (Rails 7.1.x)Analysed#2389565	Valid	Cross-site Scripting	Medium	2025-02-04	–	33
Regular expression denial of service in ActiveRecord's PostgreSQL Money typeAnalysed#1023899	Valid	Denial of Service	Medium	2021-02-11	–	33
Action Text ReDoS (Ruby 3.1 or lower)Analysed#2389431	Valid	Denial of Service	Low	2026-06-09	–	28
Argument/Code Injection via ActiveStorage's image transformation functionalityAnalysed#1154034	Valid	Command and Code Injection	High	2023-07-28	–	27
Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary MarkdownAnalysed#3994016	Valid	Cross-site Scripting	Medium	2026-09-12	–	23
Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLsAnalysed#3601655	Valid	No weakness recorded	Low	2026-04-18	–	23
Validation bypass for queries generated for PostgreSQLAnalysed#394253	Valid	No weakness recorded	–	2018-11-19	$1,500	21
Content Security Policy is only active for HTML responses but not for image/svg+xmlAnalysed#1327196	Valid	Cross-site Scripting	–	2023-07-28	–	20
Possible DoS in NumberHelpersAnalysed#2814774	Valid	Denial of Service	Medium	2026-10-06	–	18
URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tagAnalysed#3727743	Valid	Cross-site Scripting	Medium	2026-08-24	–	13

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.