CVE-2014-0081: XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human
(updated )
There is an XSS vulnerability in the number_to_currency
, number_to_percentage
and number_to_human
helpers in Ruby on Rails. These helpers allow users to nicely format a numeric value. Some helper parameters (format
, negative_format
and units
) are not escaped correctly. Applications which pass user controlled data as one of these parameters are vulnerable to an XSS attack. All users passing user controlled data to these parameters of the number helpers should either upgrade or use one of the workarounds immediately.
References
Detect and mitigate CVE-2014-0081 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →