Description
Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-i18n | 0.6.9-1 | — |
| Debian 13 | ruby-i18n | 0.6.9-1 | — |
| Debian 12 | ruby-i18n | 0.6.9-1 | — |
| Debian 7 | ruby-i18n | 0.6.0-3+deb7u1 | DSA-2830-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-i18n | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-i18n | No fix yet | — |
| Ubuntu 25.10 | ruby-i18n | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-i18n | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-i18n | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ruby-i18n | No fix yet | — |
| Ubuntu 18.04 LTS | ruby-i18n | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-i18n | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ruby-i18n | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible +1 | 2.4.3.0-1.el7ae | RHSA-2018:0380 |
| Red Hat CloudForms 5 | ansible-tower +3 | 3.1.5-3.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | bubblewrap | 0.1.7-1.el7 | RHSA-2018:0380 |
| Red Hat CloudForms 5 | cfme +3 | 5.4.0.5-1.el6cf | RHSA-2018:0380, RHSA-2017:0320, RHBA-2015:1100 |
| Red Hat CloudForms 5 | cfme-appliance-tools +2 | 5.9.0.22-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | cfme-vnc-plugin | 1.0.0-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | dbus-api-service | 1.0.1-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | dumb-init | 1.2.0-1.el7 | RHSA-2018:0380 |
| Red Hat CloudForms 5 | erlang | 19.0.4-1.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | freeipmi +4 | 1.5.1-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | google-config +1 | 2.0.0-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | httpd-configmap-generator +2 | 0.2.1-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | libdnet +2 | 1.12-11.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | lshw +1 | B.02.16-4.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | netapp-manageability-sdk +1 | 4.0P1-3.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | nginx +8 | 1:1.10.2-1.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | open-vm-tools +2 | 9.2.3-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | postgresql94 +9 | 9.4.15-3PGDG.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | prince | 9.0r2-4.el6cf | RHSA-2018:0380, RHBA-2015:1100 |
| Red Hat CloudForms 5 | pyliblzma | 0.5.3-7.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | python-crypto +1 | 2.6.1-16.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | python-jmespath +1 | 0.9.0-4.el7ae | RHSA-2018:0380 |
| Red Hat CloudForms 5 | python-meld3 | 0.6.10-1.el7 | RHSA-2018:0380 |
| Red Hat CloudForms 5 | python-paramiko +1 | 2.1.1-2.el7ae | RHSA-2018:0380 |
| Red Hat CloudForms 5 | qpid-proton +10 | 0.19.0-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rabbitmq-server | 3.6.9-1.el7at | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-postgresql95-postgresql-pglogical | 2.1.0-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-postgresql95-repmgr | 3.1.3-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-bcrypt +1 | 3.1.11-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-ffi +1 | 1.9.18-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-hamlit +1 | 2.7.5-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-http_parser.rb +1 | 0.6.0-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-json +1 | 2.0.4-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-memory_buffer +1 | 0.1.0-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-nio4r +1 | 2.1.0-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-nokogiri +1 | 1.8.1-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-ovirt-engine-sdk4 +1 | 4.2.1-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-pg +1 | 0.18.4-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-puma +1 | 3.7.1-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-redhat_access_cfme +1 | 2.0.2-2.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-redhat_access_lib | 1.1.4-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-rugged +1 | 0.25.1.1-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-sqlite3 +1 | 1.3.13-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-unf_ext +1 | 0.0.7.4-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | rh-ruby23-rubygem-websocket-driver +1 | 0.6.5-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | ruby200-rubygem-bcrypt-ruby | 3.0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-eventmachine | 1.0.7-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-ffi | 1.9.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-io-extra | 1.2.8-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-json | 1.8.2-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-nokogiri | 1.5.11-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-pg | 0.12.2-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-psych | 2.0.13-1.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-qpid_messaging | 0.20.2-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-therubyracer | 0.11.0-5.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | ruby200-rubygem-thin | 1.3.1-9.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | smem | 1.4-1.el7cf | RHSA-2018:0380 |
| Red Hat CloudForms 5 | sneakernet_ca | 0.1-2.el6cf | RHBA-2015:1100 |
| Red Hat CloudForms 5 | supervisor | 3.1.4-1.el7 | RHSA-2018:0380 |
| Red Hat CloudForms 5 | wmi | 1.3.14-1.el6cf | RHSA-2018:0380, RHBA-2015:1100 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | i18n | < 0.6.6 | 0.6.6 | GHSA-r5hc-9xx5-97rw |
Advisories 4
- RHSA-2018:0380 Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:0320 Red Hat Security Advisory: CFME 5.7.1 bug fixes and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHBA-2015:1100 Red Hat Bug Fix Advisory: CFME 5.4.0 bug fixes, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2830-1 ruby-i18n - cross-site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- openSUSE-SU-2013:1930 vendor-advisory
- 64076 vdb-entry
- [ruby-security-ann] 20131203 [CVE-2013-4491] Reflective XSS Vulnerability in Ruby on Rails mailing-list
- http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
- DSA-2830 vendor-advisory
- https://github.com/svenfuchs/i18n/commit/92b57b1e4f84adcdcc3a375278f299274be62445