# rails (RubyGems) vulnerabilities

11 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://rubygems.org/gems/rails

## Advisories (11)

### [CVE-2024-26143](https://cve.now/CVE-2024-26143): Rails Possible XSS Vulnerability in Action Controller

- Severity: Medium 6.1
- Published: Feb 27, 2024
- Affected: from 7.0.0, fixed in 7.0.8.1; from 7.1.0, fixed in 7.1.3.1.

### [CVE-2014-0081](https://cve.now/CVE-2014-0081): Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action\_view/helpers/number\_helper.rb in Ruby on Rails before 3.2.17…

- Severity: Unrated
- Published: Feb 20, 2014
- Affected: from 3.0.0, fixed in 3.2.17; from 4.0.0, fixed in 4.0.3.

### [CVE-2009-4214](https://cve.now/CVE-2009-4214): Cross-site scripting (XSS) vulnerability in the strip\_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote…

- Severity: Unrated
- Published: Dec 7, 2009
- Affected: fixed in 2.2.2; from 2.3.0, fixed in 2.3.5.

### [CVE-2009-2422](https://cve.now/CVE-2009-2422): The example code for the digest authentication functionality (http\_authentication.rb) in Ruby on Rails before 2.3.3 defines an…

- Severity: Unrated
- Published: Jul 10, 2009
- Affected: fixed in 2.3.3.

### [CVE-2008-5189](https://cve.now/CVE-2008-5189): CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…

- Severity: Unrated
- Published: Nov 21, 2008
- Affected: fixed in 2.0.5.

### [CVE-2007-6077](https://cve.now/CVE-2007-6077): The session fixation protection mechanism in cgi\_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie\_only attribute…

- Severity: Unrated
- Published: Nov 21, 2007
- Affected: fixed in 1.2.6.

### [CVE-2007-5380](https://cve.now/CVE-2007-5380): Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via…

- Severity: Unrated
- Published: Oct 19, 2007
- Affected: fixed in 1.2.4.

### [CVE-2007-5379](https://cve.now/CVE-2007-5379): Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary…

- Severity: Unrated
- Published: Oct 19, 2007
- Affected: fixed in 1.2.4.

### [CVE-2007-3227](https://cve.now/CVE-2007-3227): Cross-site scripting (XSS) vulnerability in the to\_json (ActiveRecord::Base#to\_json) function in Ruby on Rails before edge 9606 allows…

- Severity: Unrated
- Published: Jun 14, 2007
- Affected: fixed in 1.2.5.

### [CVE-2006-4112](https://cve.now/CVE-2006-4112): Unspecified vulnerability in the "dependency resolution mechanism" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute…

- Severity: Unrated
- Published: Aug 14, 2006
- Affected: from 1.1.0, fixed in 1.1.6.

### [CVE-2006-4111](https://cve.now/CVE-2006-4111): Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with…

- Severity: Unrated
- Published: Aug 14, 2006
- Affected: from 1.1.0, fixed in 1.1.6.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems/rails
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.