What’s Vulnerable › Vulnerabilities

CVE-2023-28120: Possible XSS Security Vulnerability in SafeBuffer#bytesplice

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-09 · updated 2026-06-17
• Weakness: CWE-79

Description

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

Affected products

• Rubygems Activesupport: from 7.0.0 before 7.0.4.3; before 6.1.7.3; 7.0.0, 7.0.1, 7.0.2, 7.0.2.1, 7.0.2.2, 7.0.2.3 (+416) — fixed in 7.0.4.3, 6.1.7.3
• rails activesupport: from 7.0.4.3 before 7.0.4.3; from 6.1.7.3 before 6.1.7.3 — fixed in 6.1.7.3, 7.0.4.3

How to fix

Upgrade to a fixed version: Rubygems Activesupport 7.0.4.3, 6.1.7.3; rails activesupport 6.1.7.3, 7.0.4.3. Check the vendor advisory for mitigations.

References

• https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469
• https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b70
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO/
• https://security.netapp.com/advisory/ntap-20240202-0006/
• https://www.debian.org/security/2023/dsa-5389

Get alerted when CVE-2023-28120 or the next vulnerability affects your stack