Description
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze8 | DSA-2655-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | graphviz +4 | 2.26.0-10.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-console | 0.0.16-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-broker +1 | 1.0.11-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-broker-util | 1.0.15-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-diy-0.1 +3 | 1.0.3-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-haproxy-1.4 +1 | 1.0.4-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jbossews-1.0 | 1.0.13-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-jenkins-1.4 +1 | 1.0.2-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-php-5.3 +2 | 1.0.5-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-postgresql-8.4 | 1.0.3-2.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-ruby-1.8 | 1.0.7-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-ruby-1.9-scl | 1.0.8-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | php +5 | 5.3.3-22.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-ruby +5 | 1.9.3.327-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-actionpack +3 | 1:3.2.8-3.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-bigdecimal | 1.1.0-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-io-console | 0.3-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-json | 1.5.4-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-minitest | 2.5.1-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-railties +3 | 3.2.8-2.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-rake | 0.9.2.2-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-rdoc | 3.9.4-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygem-ruby_parser +1 | 2.3.1-3.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | ruby193-rubygems +1 | 1.8.23-25.el6 | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-actionpack | 1:3.0.13-4.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-activemodel +1 | 3.0.13-3.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-activerecord | 1:3.0.13-5.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-bson +2 | 1.8.1-2.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-console +1 | 1.0.10-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-controller | 1.0.12-1.el6op | RHSA-2013:0582 |
| Red Hat OpenShift 1 | rubygem-ruby_parser +1 | 2.0.4-6.el6op | RHSA-2013:0582 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionpack | >= 3.0.0.beta, < 3.0.17 | 3.0.17 | GHSA-7g65-ghrg-hpf5 |
| RubyGems | actionpack | >= 3.1.0, < 3.1.8 | 3.1.8 | GHSA-7g65-ghrg-hpf5 |
| RubyGems | actionpack | >= 3.2.0, < 3.2.8 | 3.2.8 | GHSA-7g65-ghrg-hpf5 |
| RubyGems | actionpack | < 2.3.16 | 2.3.16 | GHSA-7g65-ghrg-hpf5 |
Advisories 2
- RHSA-2013:0582 Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1.1 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2655-1 rails - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released/
- 50694 third-party-advisory
- RHSA-2013:0154 vendor-advisory
- [rubyonrails-security] 20120810 XSS Vulnerability in strip_tags mailing-list