Description
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rails actionview
< 5.2.4.2affected>= 6.0.0, < 6.0.2.2affected
References
- https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hv ↗
- https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9a ↗
- http://www.openwall.com/lists/oss-security/2020/03/19/1 ↗
- https://lists.debian.org/debian-lts-announce/2020/03/msg00022.html ↗
- http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/ ↗