The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
SummaryAI-written · claude-haiku-5-5AI-written · claude-haiku-5-5Written by a language model from the source data on this page. Not reviewed by a person. Generated 29 Oct 2026.
The flaw is a code injection vulnerability in Rails versions prior to 5.0.1, where the locals argument of a render call is not safely handled. An attacker who can control the locals argument of a render call could achieve remote code execution.
Heading is the official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
24.9 / 100
Exploited
Not confirmed
Reports
0
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) was available 13 days before disclosure.
Patch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.
7 fixes in actionview over 9 years. The latest fix listed for actionview is 6.0.0.beta3.
Fixes in actionviewRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
1 package in 1 ecosystem. Main package: actionview.