Zurück zur CVE-Übersicht
CVE-2026-33167
MEDIUM(6.1)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Risk Signal Score15/100 — NIEDRIG
- CVSS 6.1 — Mittel
Erwähnungen (letzte 60 Tage)
Artikel
EPSS-Score
0.3%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
6.1
Technische Schwere
Beschreibung
Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.
Betroffene Produkte
- cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
GitHub Advisories
GHSA-pgm4-439c-5jp6LOW
Rails has a possible XSS vulnerability in its Action Pack debug exceptions
rubygems/actionpack→ 8.1.2.1
GitHub Advisory