CVE-2023-22797: Actionpack Project Actionpack

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.

Affected products

• Actionpack Project Actionpack: from 7.0.0, before 7.0.4.1 (fixed in 7.0.4.1)
• Rubyonrails Rails: from 7.0.0, before 7.0.4.1 (fixed in 7.0.4.1)

Published 2023-02-09. Last modified 2026-06-17.