---
title: "Rails actionpack vulnerabilities and CVEs"
url: https://radicalnotion.ai/vendor/rails/actionpack
type: product
description: "Rails actionpack has 46 published CVEs, 0 in CISA KEV and 14 with public exploits."
updated: 2026-03-23
source: RadicalNotion.AI
license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/)
---

# Rails actionpack vulnerabilities

Vendor: [Rails](https://radicalnotion.ai/vendor/rails)

- **Published CVEs:** 46
- **In CISA KEV:** 0
- **With a public exploit:** 14
- **With a patch:** 46
- **Average CVSS:** 5.7
- **First CVE:** 2009-09-08
- **Latest CVE:** 2026-03-23
- **Ecosystems:** gem

## Severity breakdown

| Severity | CVEs |
| --- | --- |
| Critical | 1 |
| High | 10 |
| Medium | 32 |
| Low | 3 |
| Unscored | 0 |

## Most common weakness types

| CWE | Name | CVEs |
| --- | --- | --- |
| [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 13 |
| [CWE-20](https://radicalnotion.ai/cwe/cwe-20) | Improper Input Validation | 8 |
| [CWE-264](https://radicalnotion.ai/cwe/cwe-264) | Permissions, Privileges, and Access Controls | 4 |
| [CWE-601](https://radicalnotion.ai/cwe/cwe-601) | URL Redirection to Untrusted Site ('Open Redirect') | 4 |
| [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 3 |
| [CWE-200](https://radicalnotion.ai/cwe/cwe-200) | Exposure of Sensitive Information to an Unauthorized Actor | 2 |
| [CWE-1333](https://radicalnotion.ai/cwe/cwe-1333) | Inefficient Regular Expression Complexity | 2 |
| [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 2 |

## CVEs by year

| Year | CVEs published |
| --- | --- |
| 2016 | 4 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 2 |
| 2021 | 4 |
| 2022 | 3 |
| 2023 | 3 |
| 2024 | 6 |
| 2025 | 1 |
| 2026 | 1 |

## Affected versions (top 24 of 174)

| Version | Kind | CVEs |
| --- | --- | --- |
| 3.0.0 \<= v \< 3.0.4 | range | 3 |
| 4.0.0 \<= v \< 4.0.2 | range | 3 |
| 7.0.0 \<= v \< 7.0.4.1 | range | 3 |
| \< 2.3.16 | range | 2 |
| 2.3.0 \<= v \< 2.3.13 | range | 2 |
| 3.0.0 \<= v \< 3.0.10 | range | 2 |
| 3.0.0 \<= v \< 3.2.16 | range | 2 |
| 3.0.0 \<= v \< 3.2.17 | range | 2 |
| 3.0.0 \<= v \< 3.2.22.2 | range | 2 |
| 4.0.0 \<= v \< 4.1.14.1 | range | 2 |
| 4.0.0 \<= v \< 4.1.14.2 | range | 2 |
| 5.0.0 \<= v \< 5.2.4.3 | range | 2 |
| 2.3.13 | patched | 3 |
| 3.0.4 | patched | 3 |
| 4.0.2 | patched | 3 |
| 7.0.4.1 | patched | 3 |
| 2.3.11 | patched | 2 |
| 2.3.16 | patched | 2 |
| 3.0.10 | patched | 2 |
| 3.2.16 | patched | 2 |
| 3.2.17 | patched | 2 |
| 3.2.22.1 | patched | 2 |
| 3.2.22.2 | patched | 2 |
| 4.1.14.1 | patched | 2 |

## CVEs (first 30 of 46, most severe first)

| CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch |
| --- | --- | --- | --- | --- | --- | --- |
| CVE-2026-33167 | Rails has a possible XSS vulnerability in its Action Pack debug exceptions | low | 1.3 | No | No | Yes |
| CVE-2023-28362 | Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect\_to | medium | 4.0 | No | No | Yes |
| CVE-2024-54133 | Possible Content Security Policy bypass in Action Dispatch | low | 2.3 | No | No | Yes |
| CVE-2024-47887 | Action Controller has possible ReDoS vulnerability in HTTP Token authentication | medium | 6.6 | No | No | Yes |
| CVE-2024-41128 | Action Dispatch has possible ReDoS vulnerability in query parameter filtering | medium | 6.6 | No | No | Yes |
| CVE-2024-28103 | Action Pack is missing security headers on non-HTML responses | critical | 9.8 | No | No | Yes |
| CVE-2024-26143 | Rails Possible XSS Vulnerability in Action Controller | medium | 6.1 | No | Yes | Yes |
| CVE-2024-26142 | Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch | high | 7.5 | No | Yes | Yes |
| CVE-2023-22797 | Open Redirect Vulnerability in Action Pack | medium | 6.1 | No | No | Yes |
| CVE-2023-22795 | ReDoS based DoS vulnerability in Action Dispatch | high | 7.5 | No | No | Yes |
| CVE-2023-22792 | ReDoS based DoS vulnerability in Action Dispatch | high | 7.5 | No | No | Yes |
| CVE-2022-22577 | Cross-site Scripting Vulnerability in Action Pack | medium | 6.1 | No | No | Yes |
| CVE-2022-23633 | Exposure of sensitive information in Action Pack | high | 7.4 | No | No | Yes |
| CVE-2021-44528 | actionpack Open Redirect in Host Authorization Middleware | medium | 6.1 | No | No | Yes |
| CVE-2011-1497 | Cross site scripting in actionpack Rubygem | medium | 6.1 | No | Yes | Yes |
| CVE-2021-22942 | Open Redirect in ActionPack | medium | 6.1 | No | No | Yes |
| CVE-2021-22904 | Possible DoS Vulnerability in Action Controller Token Authentication | high | 7.5 | No | Yes | Yes |
| CVE-2021-22881 | Actionpack Open Redirect Vulnerability | medium | 6.1 | No | Yes | Yes |
| CVE-2020-8166 | Ability to forge per-form CSRF tokens in Rails | medium | 4.3 | No | Yes | Yes |
| CVE-2020-8164 | Possible Strong Parameters Bypass in ActionPack | high | 7.5 | No | Yes | Yes |
| CVE-2016-2098 | actionpack allows remote code execution via application's unrestricted use of render method | high | 7.3 | No | Yes | Yes |
| CVE-2016-2097 | actionview contains Path Traversal vulnerability | medium | 5.3 | No | No | Yes |
| CVE-2016-0751 | actionpack is vulnerable to denial of service via a crafted HTTP Accept header | high | 7.5 | No | No | Yes |
| CVE-2015-7576 | actionpack is vulnerable to remote bypass authentication | low | 3.7 | No | No | Yes |
| CVE-2014-0082 | actionpack Improper Input Validation vulnerability | medium | 5.0 | No | No | Yes |
| CVE-2014-0081 | Rails vulnerable to Cross-site Scripting | medium | 4.3 | No | No | Yes |
| CVE-2013-6417 | actionpack allows bypass of database-query restrictions | medium | 6.4 | No | No | Yes |
| CVE-2013-6416 | actionpack Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes |
| CVE-2013-6414 | actionpack Improper Input Validation vulnerability | medium | 5.0 | No | Yes | Yes |
| CVE-2013-1857 | actionpack Cross-site Scripting vulnerability | medium | 4.3 | No | No | Yes |

## Frequently asked questions

### How many CVEs does Rails actionpack have?

Rails actionpack has 46 published CVE records since 2009.

### How many Rails actionpack CVEs are in CISA KEV?

None of Rails actionpack's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

### Are there public exploits for Rails actionpack vulnerabilities?

Yes — 14 of Rails actionpack's CVEs have a known public exploit.

### Which versions of Rails actionpack are affected?

174 distinct Rails actionpack versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

### What are the most common weakness types in Rails actionpack CVEs?

Rails actionpack's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-20 (Improper Input Validation), CWE-264 (Permissions, Privileges, and Access Controls), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')).

### How many critical Rails actionpack vulnerabilities are there?

Rails actionpack has 1 critical and 10 high-severity CVEs.

### What is the average severity of Rails actionpack CVEs?

The average CVSS base score across Rails actionpack's scored CVEs is 5.7.

## Other products from this vendor

- [rails](https://radicalnotion.ai/vendor/rails/rails) (110 CVEs)
- [activerecord](https://radicalnotion.ai/vendor/rails/activerecord) (15 CVEs)
- [rails-html-sanitizer](https://radicalnotion.ai/vendor/rails/rails-html-sanitizer) (15 CVEs)
- [ActiveSupport](https://radicalnotion.ai/vendor/rails/activesupport) (13 CVEs)
- [activestorage](https://radicalnotion.ai/vendor/rails/activestorage) (9 CVEs)
- [actionview](https://radicalnotion.ai/vendor/rails/actionview) (8 CVEs)
- [https://github.com/rails/rails](https://radicalnotion.ai/vendor/rails/https-github-com-rails-rails) (3 CVEs)
- [actionmailer](https://radicalnotion.ai/vendor/rails/actionmailer) (2 CVEs)

---

Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/rails/actionpack). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.