Description
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-jquery-rails | 4.0.4-1 | — |
| Debian 13 | ruby-jquery-rails | 4.0.4-1 | — |
| Debian 12 | ruby-jquery-rails | 4.0.4-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-jquery-rails | 4.5.1-1.3 | openSUSE-SU-2024:13159-1 |
| openSUSE Tumbleweed | rubygem-jquery-rails | 4.5.0-1.1 | openSUSE-SU-2026:10350-1, openSUSE-SU-2025:15117-1, openSUSE-SU-2024:14169-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | jquery-rails | < 3.1.3 | 3.1.3 | GHSA-4whc-pp4x-9pf3 |
| RubyGems | jquery-rails | >= 4.0.0, < 4.0.4 | 4.0.4 | GHSA-4whc-pp4x-9pf3 |
| RubyGems | jquery-ujs | < 1.0.4 | 1.0.4 | GHSA-4whc-pp4x-9pf3 |
Advisories 5
- openSUSE-SU-2026:10350-1 ruby4.0-rubygem-jquery-rails-4.6.0-1.9 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2024:13159-1 ruby3.2-rubygem-jquery-rails-4.5.1-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14169-1 ruby3.3-rubygem-jquery-rails-4.6.0-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15117-1 ruby3.4-rubygem-jquery-rails-4.6.0-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12144-1 ruby3.1-rubygem-jquery-rails-4.5.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- FEDORA-2015-10144 vendor-advisory
- openSUSE-SU-2015:1260 vendor-advisory
- [oss-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails mailing-list
- FEDORA-2015-10258 vendor-advisory
- [rubyonrails-security] 20150616 [CVE-2015-1840] CSRF Vulnerability in jquery-ujs and jquery-rails mailing-list
- 75239 vdb-entry
- https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md
- https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md