Moderate severity vulnerability that affects rails (GHSA-9p3v-wf2w-v29c)
Published: 2017-10-24T18:33:38Z
Aliases: CVE-2009-4214
Severity: MODERATE · CWE: CWE-79

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Affected packages:
package: ecosystem: RubyGems
name: rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.2
package: ecosystem: RubyGems
name: rails
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.5