File writing by Directory traversal at actionpack-page_caching and RCE by it Analysed #519220 Valid File and Path Handling High 2020-07-13 $1,000 80 ActiveStorage Disk Service Path Traversal via Custom Blob Key Injection Analysed #3580511 Valid File and Path Handling Medium 2026-05-07 – 57 XSS when using `translate` in Action Controller (Rails 7.0, 7.1) Analysed #2303609 Valid Cross-site Scripting Low 2024-10-01 – 50 Rack parses encoded cookie names allowing an attacker to send malicious `__Host-` and `__Secure-` prefixed cookies Analysed #895727 Valid Input Validation and Logic Low 2020-06-16 – 46 XSS vulnerabilities due to missing checks in tag helpers Analysed #1444151 Valid Cross-site Scripting Medium 2023-07-28 – 41 RCE which may occur due to `ActiveSupport::MessageVerifier` or `ActiveSupport::MessageEncryptor` (especially Active storage) Analysed #473888 Valid Command and Code Injection High 2019-03-13 $1,500 41 Path Traversal on Default Installed Rails Application (Asset Pipeline) Analysed #307808 Valid File and Path Handling Medium 2018-07-19 $1,500 38 Action Text XSS (Rails 7.1.x) Analysed #2389565 Valid Cross-site Scripting Medium 2025-02-04 – 33 Regular expression denial of service in ActiveRecord's PostgreSQL Money type #1023899 Valid Denial of Service Medium 2021-02-11 – 33 Action Text ReDoS (Ruby 3.1 or lower) #2389431 Valid Denial of Service Low 2026-06-09 – 28 Argument/Code Injection via ActiveStorage's image transformation functionality #1154034 Valid Command and Code Injection High 2023-07-28 – 27 DoS with crafted "Range" header #2307813 Valid No weakness recorded High 2024-06-25 – 24 ActionView sanitize helper bypass leading to XSS using SVG tag. #1694173 Valid Cross-site Scripting Medium 2023-07-10 – 24 Action Text to_markdown: <code>/<pre> content escapes its delimiter, letting a stored body inject arbitrary Markdown #3994016 Valid Cross-site Scripting Medium 2026-09-12 – 23 Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLs #3601655 Valid No weakness recorded Low 2026-04-18 – 23 Validation bypass for queries generated for PostgreSQL #394253 Valid No weakness recorded – 2018-11-19 $1,500 21 Content Security Policy is only active for HTML responses but not for image/svg+xml #1327196 Valid Cross-site Scripting – 2023-07-28 – 20 Open Redirect (6.0.0 < rails < 6.0.3.2) #904059 Valid Open Redirect High 2020-12-22 $1,000 19 Possible DoS in NumberHelpers #2814774 Valid Denial of Service Medium 2026-10-06 – 18 ReDoS in Rack::Multipart #1489141 Valid No weakness recorded High 2023-07-28 – 18 XSS vulnerability in sanitize-method when parsing link's href #328270 Valid Cross-site Scripting Medium 2018-03-22 – 18 Subdomain Takeover at https://new.rubyonrails.org/ #1429148 Valid Access Control High 2022-03-03 – 17 Specially constructed multi-part requests cause multi-second response times; vulnerable to DoS #431561 Valid No weakness recorded Medium 2018-12-05 – 17 Incorrect handling of certain characters passed to the redirection functionality in Rails can lead to a single-click XSS vulnerability. #1955370 Valid Cross-site Scripting Medium 2023-07-28 – 15 URI scheme validation bypass in ActionText `to_markdown` via user-supplied `<action-text-markdown>` marker tag #3727743 Valid Cross-site Scripting Medium 2026-08-24 – 13 Missing resource identifier encoding may lead to security vulnerabilities #803922 Valid Information Disclosure Medium 2020-05-13 – 13 XSS due to incomplete JS escaping #474262 Valid Cross-site Scripting Low 2020-05-14 – 13 RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1 #44513 Valid Command and Code Injection – 2015-06-16 – 13 ReDoS (Rails::Html::PermitScrubber.scrub_attribute) #1684163 Valid No weakness recorded – 2023-01-02 – 11 redirect_to(["string"]) remote code execution #1106652 Valid Information Disclosure Low 2021-05-07 – 9 Nested attributes reject_if proc can be circumvented by providing "_destroy" parameter #90457 Valid No weakness recorded High 2016-02-12 – 9 Explicit, dynamic render path: Dir. Trav + RCE #46019 Valid Command and Code Injection High 2016-02-12 $500 9 Rails::Html::SafeListSanitizer vulnerable to XSS when certain tags are allowed (math+style || svg+style) #1656627 Valid Cross-site Scripting Medium 2022-12-14 – 8 Rails::Html::SafeListSanitizer vulnerable to xss attack in an environment that allows the style tag #1530898 Valid Cross-site Scripting Medium 2022-06-14 – 8 ActiveStorage service's signed URLs can be hijacked via AppCache+Cookie stuffing trick when using GCS or DiskService #407319 Valid Information Disclosure High 2018-12-27 – 8 JSON keys are not properly escaped #47280 Valid Cross-site Scripting High 2015-06-16 – 8 Denial of Service in Action Pack Exception Handling #42797 Valid Denial of Service – 2015-06-16 – 8 Directory traversal attack in view resolver #3370 Valid Information Disclosure – 2015-07-09 – 8 Incomplete fix for CVE-2022-32209 (XSS in Rails::Html::Sanitizer under certain configurations) #1654310 Valid Cross-site Scripting Medium 2022-12-14 – 7 HostAuthorization middleware does not suitably sanitize the Host / X-Forwarded-For header allowing redirection. #1047447 Valid Open Redirect Low 2021-02-11 – 7 The authenticity_token can be reversed and used to forge valid per_form_csrf_tokens for arbitrary routes #732415 Valid Cross-Site Request Forgery Medium 2020-08-27 – 7 Unsafe Query Generation (CVE-2012-2660, CVE-2012-2694 and CVE-2013-0155) mitigation bypass #139321 Valid No weakness recorded – 2018-02-07 – 7 Remote code execution using render :inline #113928 Valid Command and Code Injection – 2016-03-01 $1,500 7 http_basic_authenticate_with is suseptible to timing attacks. #94568 Valid Authentication – 2016-03-13 – 7 Regarding [CVE-2016-0752] Possible Information Leak Vulnerability in Action View #113831 Valid Command and Code Injection – 2016-03-01 – 6 Data-Tags and the New HTML Sanitizer Subverts CSRF protection #42728 Valid Cross-site Scripting – 2016-03-13 – 6 Server-side template injection at ujs test server #942103 Valid Command and Code Injection None 2021-02-16 – 5 ActiveStorage direct upload fails to sign content-length header for S3 service #789579 Valid Input Validation and Logic Medium 2020-05-18 – 5 Validation bypass for Active Record and Active Model #108723 Valid Misconfiguration and Insecure Design Medium 2016-02-12 – 5 Potential XSS on sanitize/Rails::Html::WhiteListSanitizer #81212 Valid Cross-site Scripting – 2016-03-13 – 5