# actionview (RubyGems) vulnerabilities 13 known vulnerabilities (2 high, 3 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/actionview ## Advisories (13) ### [CVE-2026-33168](https://cve.now/CVE-2026-33168): Rails has a possible XSS vulnerability in its Action View tag helpers - Severity: Low 2.3 - Published: Mar 23, 2026 - Affected: from 8.1.0.beta1, fixed in 8.1.2.1; from 8.0.0.beta1, fixed in 8.0.4.1; fixed in 7.2.3.1. ### [CVE-2023-23913](https://cve.now/CVE-2023-23913): There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are… - Severity: Medium 6.3 - Published: Jan 9, 2025 - Affected: from 5.1.0, fixed in 6.1.7.3; from 7.0.0, fixed in 7.0.4.3. ### [CVE-2022-27777](https://cve.now/CVE-2022-27777): A XSS Vulnerability in Action View tag helpers \>= 5.2.0 and \< 5.2.0 which would allow an attacker to inject content if able to control… - Severity: Unrated - Published: May 26, 2022 - Affected: fixed in 5.2.7.1; from 6.0.0, fixed in 6.0.4.8; from 6.1.0, fixed in 6.1.5.1; from 7.0.0, fixed in 7.0.2.4. ### [CVE-2020-15169](https://cve.now/CVE-2020-15169): XSS in Action View - Severity: Medium 5.4 - Published: Sep 11, 2020 - Affected: fixed in 5.2.4.4; from 6.0.0.0, fixed in 6.0.3.3. ### [CVE-2020-8163](https://cve.now/CVE-2020-8163): The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the \`locals\` argument… - Severity: Unrated - Published: Jul 2, 2020 - Affected: fixed in 4.2.11.3. ### [CVE-2020-8167](https://cve.now/CVE-2020-8167): A CSRF vulnerability exists in rails \<= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains. - Severity: Unrated - Published: Jun 19, 2020 - Affected: from 5.0.0, fixed in 5.2.4.3; from 6.0.0, fixed in 6.0.3.1. ### [CVE-2020-5267](https://cve.now/CVE-2020-5267): Possible XSS vulnerability in ActionView - Severity: Medium 4.0 - Published: Mar 19, 2020 - Affected: fixed in 5.2.4.2; from 6.0.0, fixed in 6.0.2.2. ### [CVE-2019-5419](https://cve.now/CVE-2019-5419): There is a possible denial of service vulnerability in Action View (Rails) \<5.2.2.1, \<5.1.6.2, \<5.0.7.2, \<4.2.11.1 where specially crafted… - Severity: Unrated - Published: Mar 27, 2019 - Affected: from 4.0.0, fixed in 4.2.11.1; from 5.2.0, fixed in 5.2.2.1; from 5.1.0, fixed in 5.1.6.2; from 5.0.0, fixed in 5.0.7.2; from 6.0.0.beta1, fixed in 6.0.0.beta3. ### [CVE-2019-5418](https://cve.now/CVE-2019-5418): There is a File Content Disclosure vulnerability in Action View \<5.2.2.1, \<5.1.6.2, \<5.0.7.2, \<4.2.11.1 and v3 where specially crafted accep - Severity: High 7.5 · KEV - Published: Mar 27, 2019 - Affected: from 5.2.0, fixed in 5.2.2.1; from 4.0.0, fixed in 4.2.11.1; from 5.1.0, fixed in 5.1.6.2; from 5.0.0, fixed in 5.0.7.2. ### [CVE-2016-6316](https://cve.now/CVE-2016-6316): Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1… - Severity: Unrated - Published: Sep 7, 2016 - Affected: from 3.0.0, fixed in 3.2.22.3; from 4.0.0, fixed in 4.2.7.1; from 5.0.0, fixed in 5.0.0.1. ### [CVE-2016-2097](https://cve.now/CVE-2016-2097): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read… - Severity: Unrated - Published: Apr 7, 2016 - Affected: from 3.0.0, fixed in 3.2.22.2; from 4.0.0, fixed in 4.1.14.2. ### [CVE-2016-0752](https://cve.now/CVE-2016-0752): Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, an - Severity: High 7.5 · KEV - Published: Feb 16, 2016 - Affected: from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1. ### [CVE-2011-0446](https://cve.now/CVE-2011-0446): Multiple cross-site scripting (XSS) vulnerabilities in the mail\_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when… - Severity: Unrated - Published: Feb 14, 2011 - Affected: fixed in 2.3.11; from 3.0.0, fixed in 3.0.4. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/actionview Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.