CVE-2020-8264: Rubyonrails Rails

Medium severity, CVSS 6.1. EPSS: 67% chance of exploitation in the next 30 days.

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.

Affected products

• Rubyonrails Rails: from 6.0.0, before 6.0.3.4 (fixed in 6.0.3.4)

Published 2021-01-06. Last modified 2026-06-17.