The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument o

Summary

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Timeline

1. Jul 2, 2020, 6:35 PM UTCCVE published
2. Jul 26, 2020Public exploit on Exploit-DB

   EDB-48716

3. Aug 4, 2024, 9:48 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a https://github.com/rails/rails

  Fixed in 4.2.11.2

• actionviewRubyGems

  fixed in 4.2.11.3

References 9