CVE-2020-15169: XSS in Action View

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-11 · updated 2026-06-17
Weakness: CWE-79

Description

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Affected products

Action View Project Action View: before 5.2.4.4; from 6.0.0.0 before 6.0.3.3 — fixed in 5.2.4.4, 6.0.3.3
Debian Linux: 10.0
Fedoraproject Fedora: 33
Rubygems Actionview: before 5.2.4.4; from 6.0.0.0 before 6.0.3.3; 4.1.0, 4.1.0.beta1, 4.1.0.beta2, 4.1.0.rc1, 4.1.0.rc2, 4.1.1 (+149) — fixed in 5.2.4.4, 6.0.3.3

How to fix

Upgrade to a fixed version: Action View Project Action View 5.2.4.4, 6.0.3.3; Rubygems Actionview 5.2.4.4, 6.0.3.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-15169 or the next vulnerability affects your stack