CVE-2020-36190: Rails Admin Project Rails Admin

Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days.

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.

Affected products

• Rails Admin Project Rails Admin: before 1.4.3 (fixed in 1.4.3); from 2.0.0, before 2.0.2 (fixed in 2.0.2)

Published 2021-01-12. Last modified 2026-06-17.