Description
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rails | rails | >= 7.0.0, < 7.0.8.1, >= 7.1.0, < 7.1.3.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rails | No fix yet | — |
| Ubuntu 26.04 LTS | rails | No fix yet | — |
| Ubuntu 25.10 | rails | No fix yet | — |
| Ubuntu 24.04 LTS | rails | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | rails | No fix yet | — |
| Ubuntu Pro 20.04 LTS | rails | No fix yet | — |
| Ubuntu Pro 18.04 LTS | rails | No fix yet | — |
| Ubuntu Pro 16.04 LTS | rails | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-rails-7.0 +1 | 7.0.8.4-1.1 | openSUSE-SU-2025:15124-1, openSUSE-SU-2025:15110-1, openSUSE-SU-2024:14074-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionpack | >= 7.0.0, < 7.0.8.1 | 7.0.8.1 | GHSA-9822-6m93-xqf4 |
| RubyGems | actionpack | >= 7.1.0, < 7.1.3.1 | 7.1.3.1 | GHSA-9822-6m93-xqf4 |
| RubyGems | rails | >= 7.0.0, < 7.0.8.1 | 7.0.8.1 | GHSA-9822-6m93-xqf4 |
| RubyGems | rails | >= 7.1.0, < 7.1.3.1 | 7.1.3.1 | GHSA-9822-6m93-xqf4 |
Advisories 5
- openSUSE-SU-2024:14067-1 ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15124-1 ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14074-1 ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15110-1 ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0462 Ruby on Rails: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2025
References
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml
- https://security.netapp.com/advisory/ntap-20240510-0004/