Skip to content
OpenAdvisories
Medium USN-4560-1 1 CVE

ruby-gon vulnerability

Published Sep 30, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Gon gem did not properly escape certain input. An
attacker could use this vulnerability to execute a cross-site scripting
(XSS) attack.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 18.04 LTS 18.04:LTS ruby-gon 6.1.0-1+deb9u1build0.18.04.1

Vulnerabilities 1

  • Medium 6.1
    CVE-2020-25739

    Gon gem lack of escaping certain input when outputting as JSON

    An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on Mu…

    gon ruby-gon ruby-gon Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2020-25739