Description
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2:4.2.4-2 | — |
| Debian 13 | rails | 2:4.2.4-2 | — |
| Debian 12 | rails | 2:4.2.4-2 | — |
| Debian 8 | rails | 2:4.1.8-1+deb8u1 | DSA-3464-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | rubygem-activesupport-4_1 | 4.1.9-9.2 | SUSE-SU-2016:0082-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-activesupport-4_2 | 5.0.0.1-1.1 | openSUSE-SU-2024:10574-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activesupport | >= 4.1.0, < 4.1.11 | 4.1.11 | GHSA-vxvp-4xwc-jpp6 |
| RubyGems | activesupport | >= 4.2.0, < 4.2.2 | 4.2.2 | GHSA-vxvp-4xwc-jpp6 |
Advisories 3
- DSA-3464-1 rails - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10574-1 ruby2.2-rubygem-activesupport-4_2-4.2.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0082-1 Security update for rubygem-activesupport-4_1 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 1033755 vdb-entry
- [rubyonrails-security] 20150616 [CVE-2015-3226] XSS Vulnerability in ActiveSupport::JSON.encode mailing-list
- 75231 vdb-entry
- [oss-security] 20150616 [CVE-2015-3226] XSS Vulnerability in ActiveSupport::JSON.encode mailing-list
- DSA-3464 vendor-advisory