{"id":"CVE-2020-8264","published":"2021-01-06T21:02:35Z","modified":"2024-08-04T09:56:28Z","title":"In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode…","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["6.0.3.4"]}],"description":{"text":"In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a cross-site scripting vulnerability in the Actionable Exceptions middleware of the actionpack gem, affecting versions 6.0.0 and later. It applies only when the application runs in development mode. An attacker who can get a victim to open a specially crafted URL, or to load one embedded in another page, can execute JavaScript in the context of the local application.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:23:37Z"},"cvss":null,"epss":{"score":0.66986,"percentile":0.99296,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://hackerone.com/reports/904059","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.4"],"patched":["6.0.3.4"],"from":["GHSA-35mm-cc6r-8fjp"],"provenance":"source"}],"advisories":[{"id":"GHSA-35mm-cc6r-8fjp","url":"https://github.com/advisories/GHSA-35mm-cc6r-8fjp","severity":"MODERATE","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.4"],"patched":["6.0.3.4"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0742","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0742","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-01-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-8264","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.86,"detail":"percentile 0.9930"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-8164","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false,"link":{"from":"CVE-2020-8185","to":"CVE-2020-8264","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.2","toFixed":"6.0.3.4","daysApart":188}]}},{"cve":"CVE-2020-8264","published":"2021-01-06","fixed":"6.0.3.4","kev":false},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false,"link":{"from":"CVE-2020-8264","to":"CVE-2021-22881","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.4","toFixed":"6.0.3.5","daysApart":36}]}},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22902","published":"2021-06-11","fixed":"6.1.3.2","kev":false}],"package":"RubyGems:actionpack"}}