Skip to content
OpenAdvisories
Medium DSA-5389-1 2 CVEs

rails - security update

Published Apr 14, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 rails 2:6.0.3.7+dfsg-2+deb11u2

Vulnerabilities 2

  • Medium 6.3
    CVE-2023-23913

    rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

    There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clip…

    rails rails-ujs rails rails Debian Ubuntu RubyGems
  • Medium 5.3
    CVE-2023-28120

    Possible XSS Security Vulnerability in SafeBuffer#bytesplice

    There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

    rails activesupport rails rails Debian Ubuntu Alpine RubyGems