Skip to content
OpenAdvisories

Package · RubyGems

actionview

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 5.4
    CVE-2020-15169 Public exploit

    XSS in Action View

    In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could …

    rails actionview rails rails Debian Ubuntu RubyGems
  • High 8.8
    CVE-2020-8163 Public exploit Scanner template EPSS 82%

    Remote code execution via user-provided local names in ActionView

    The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

    rails rails actionview Debian Ubuntu RubyGems
  • Medium 4.0
    CVE-2020-5267 Public exploit

    Possible XSS vulnerability in ActionView

    In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions…

    rails actionview rails rails Debian Ubuntu RubyGems
  • High 7.5
    CVE-2019-5418 Exploited Public exploit Scanner template EPSS 99%

    Path Traversal in Action View

    There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

    rails https://github.com/rails/rails rails rails Debian Ubuntu RubyGems
    KEV Jul 7, 2025
  • High 7.5
    CVE-2016-0752 Exploited Public exploit EPSS 96%

    Directory traversal vulnerability in Action View in Ruby on Rails

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted …

    rails actionpack actionview Debian RubyGems
    KEV Mar 25, 2022