--- title: "Rails actionview vulnerabilities and CVEs" url: https://radicalnotion.ai/vendor/rails/actionview type: product description: "Rails actionview has 8 published CVEs, 0 in CISA KEV and 3 with public exploits." updated: 2026-03-23 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # Rails actionview vulnerabilities Vendor: [Rails](https://radicalnotion.ai/vendor/rails) - **Published CVEs:** 8 - **In CISA KEV:** 0 - **With a public exploit:** 3 - **With a patch:** 8 - **Average CVSS:** 5.3 - **First CVE:** 2011-02-14 - **Latest CVE:** 2026-03-23 - **Ecosystems:** gem ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 0 | | High | 1 | | Medium | 6 | | Low | 1 | | Unscored | 0 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 5 | | [CWE-22](https://radicalnotion.ai/cwe/cwe-22) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1 | | [CWE-400](https://radicalnotion.ai/cwe/cwe-400) | Uncontrolled Resource Consumption | 1 | | [CWE-80](https://radicalnotion.ai/cwe/cwe-80) | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 1 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2016 | 1 | | 2017 | 0 | | 2018 | 0 | | 2019 | 1 | | 2020 | 2 | | 2021 | 0 | | 2022 | 1 | | 2023 | 0 | | 2024 | 0 | | 2025 | 1 | | 2026 | 1 | ## Affected versions (top 31 of 47) | Version | Kind | CVEs | | --- | --- | --- | | \< 5.2.4.2 | exact | 1 | | \< 5.2.4.4 | exact | 1 | | \< 7.2.3.1 | exact | 1 | | \>= 6.0.0, \< 6.0.2.2 | exact | 1 | | \>= 6.0.0.0, \< 6.0.3.3 | exact | 1 | | \>= 8.0.0.beta1, \< 8.0.4.1 | exact | 1 | | \>= 8.1.0.beta1, \< 8.1.2.1 | exact | 1 | | \< 2.3.11 | range | 1 | | \< 5.2.4.4 | range | 1 | | \< 5.2.7.1 | range | 1 | | \< 7.2.3.1 | range | 1 | | 3.0.0 \<= v \< 3.0.4 | range | 1 | | 3.0.0 \<= v \< 3.2.22.2 | range | 1 | | 4.0.0 \<= v \< 4.1.14.2 | range | 1 | | 4.0.0 \<= v \< 4.2.11.1 | range | 1 | | 5.0.0 \<= v \< 5.0.7.2 | range | 1 | | 5.1.0 \<= v \< 5.1.6.2 | range | 1 | | 5.1.0 \<= v \< 6.1.7.3 | range | 1 | | 5.2.0 \<= v \< 5.2.2.1 | range | 1 | | 2.3.11 | patched | 1 | | 3.0.4 | patched | 1 | | 3.2.22.2 | patched | 1 | | 4.1.14.2 | patched | 1 | | 4.2.11.1 | patched | 1 | | 5.0.7.2 | patched | 1 | | 5.1.6.2 | patched | 1 | | 5.2.2.1 | patched | 1 | | 5.2.4.4 | patched | 1 | | 5.2.7.1 | patched | 1 | | 6.0.0.beta3 | patched | 1 | | 6.0.3.3 | patched | 1 | ## CVEs | CVE | Title | Severity | CVSS | CISA KEV | Public exploit | Patch | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-33168 | Rails has a possible XSS vulnerability in its Action View tag helpers | low | 2.3 | No | No | Yes | | CVE-2023-23913 | rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements | medium | 6.3 | No | No | Yes | | CVE-2022-27777 | XSS Vulnerability in Action View tag helpers | medium | 6.1 | No | Yes | Yes | | CVE-2020-15169 | XSS in Action View | medium | 6.1 | No | No | Yes | | CVE-2020-5267 | Possible XSS vulnerability in ActionView | medium | 4.8 | No | Yes | Yes | | CVE-2019-5419 | Denial of Service Vulnerability in Action View | high | 7.5 | No | Yes | Yes | | CVE-2016-2097 | actionview contains Path Traversal vulnerability | medium | 5.3 | No | No | Yes | | CVE-2011-0446 | Rails actionpack gem vulnerable to Cross-site Scripting | medium | 4.3 | No | No | Yes | ## Frequently asked questions ### How many CVEs does Rails actionview have? Rails actionview has 8 published CVE records since 2011. ### How many Rails actionview CVEs are in CISA KEV? None of Rails actionview's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Are there public exploits for Rails actionview vulnerabilities? Yes — 3 of Rails actionview's CVEs have a known public exploit. ### Which versions of Rails actionview are affected? 47 distinct Rails actionview versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version. ### What are the most common weakness types in Rails actionview CVEs? Rails actionview's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-400 (Uncontrolled Resource Consumption), CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)). ### What is the average severity of Rails actionview CVEs? The average CVSS base score across Rails actionview's scored CVEs is 5.3. ## Other products from this vendor - [rails](https://radicalnotion.ai/vendor/rails/rails) (110 CVEs) - [actionpack](https://radicalnotion.ai/vendor/rails/actionpack) (46 CVEs) - [activerecord](https://radicalnotion.ai/vendor/rails/activerecord) (15 CVEs) - [rails-html-sanitizer](https://radicalnotion.ai/vendor/rails/rails-html-sanitizer) (15 CVEs) - [ActiveSupport](https://radicalnotion.ai/vendor/rails/activesupport) (13 CVEs) - [activestorage](https://radicalnotion.ai/vendor/rails/activestorage) (9 CVEs) - [https://github.com/rails/rails](https://radicalnotion.ai/vendor/rails/https-github-com-rails-rails) (3 CVEs) - [actionmailer](https://radicalnotion.ai/vendor/rails/actionmailer) (2 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/rails/actionview). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.