CVE-2020-15169

CVE-2020-15169, GHSA-cfjv-5498-mph5

gem/actionview

Cross-site Scripting

In Action View there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the t and translate helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped.

All versions before 5.2.4.4, all versions starting from 6.0.0.0 before 6.0.3.3

Upgrade to versions 5.2.4.4, 6.0.3.3 or above.

2020-09-17