CVE-2020-8264

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 67.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-01-06 · updated 2026-06-17
Weakness: CWE-79

Description

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.

Affected products

Ruby on Rails: from 6.0.0 before 6.0.3.4 — fixed in 6.0.3.4

How to fix

Upgrade to a fixed version: Ruby on Rails 6.0.3.4. Check the vendor advisory for mitigations.

References

https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
https://hackerone.com/reports/904059
https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
https://hackerone.com/reports/904059

Get alerted when CVE-2020-8264 or the next vulnerability affects your stack