CVE-2012-3464: Rubyonrails Rails

Medium severity, CVSS 4.3. EPSS: 2.6% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.

Affected products

• Rubyonrails Rails: version 0.9.1 only; version 0.9.2 only; version 0.9.3 only; version 0.9.4 only; version 0.9.4.1 only; version 0.10.0 only; …
• Rubyonrails Ruby On Rails: up to and including 3.0.16; version 0.5.0 only; version 0.5.5 only; version 0.5.6 only; version 0.5.7 only; version 0.6.0 only; …

Published 2012-08-10. Last modified 2026-06-16.