rails Action Pack vulnerabilities

Latest rails Action Pack CVEs

Newest publication first

1. CVE-2023-28362 Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

   Published 2025-01-09

   Medium·CVSS 4.0 EPSS 0.33% PoC

   The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.