#VU8581 Cross-site scripting in Ruby on Rails

Published: 2016-01-26 | Updated: 2017-09-22

Vulnerability identifier: #VU8581

Vulnerability risk: Low


CVE-ID: CVE-2015-7578


Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Ruby on Rails
Universal components / Libraries / Scripting languages

Vendor: Rails


Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x. A remote authenticated attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Update to version

Vulnerable software versions

Ruby on Rails: 4.2.0 -


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability