Geminabox contains Cross-site Scripting (GHSA-653m-r33x-39ff)
Published: 2017-11-29T23:20:14Z
Aliases: CVE-2017-16792
Severity: MODERATE · CWE: CWE-79

Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script via the "homepage" value of a ".gemspec" file, related to views/gem.erb and views/index.erb.

Affected packages:
package: ecosystem: RubyGems
name: geminabox
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.13.10