💎

💎 RubyGems

Not in CISA KEV

MEDIUM severity

CVE-2020-5267 — actionview

CVE-2020-5267 is a medium-severity (CVSS 4.8) CWE-80 vulnerability in actionview. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for actionview — see the affected versions and patch details below.

Cross site scripting vulnerability in ActionView

Also known asGHSA-65cv-r6x7-79hv

Published

Mar 19, 2020

Updated

Oct 20, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

2 known

Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗

1.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs75th percentile — riskier than 75% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected

💎actionview💎actionview

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.

Description

There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the j or escape_javascript methods may be susceptible to XSS attacks.

Impact

There is a possible XSS vulnerability in the j and escape_javascript methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this:

<script>let a = `<%= j unknown_input %>`</script>

<script>let a = `<%= escape_javascript unknown_input %>`</script>

Releases

The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.

Workarounds

For those that can't upgrade, the following monkey patch may be used:

ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
  {
    "`" => "\\`",
    "$" => "\\$"
  }
)

module ActionView::Helpers::JavaScriptHelper
  alias :old_ej :escape_javascript
  alias :old_j :j

  def escape_javascript(javascript)
    javascript = javascript.to_s
    if javascript.empty?
      result = ""
    else
      result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
    end
    javascript.html_safe? ? result.html_safe : result
  end

  alias :j :escape_javascript
end

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

5-2-js-helper-xss.patch - Patch for 5.2 series
6-0-js-helper-xss.patch - Patch for 6.0 series

Please note that only the 5.2 and 6.0 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits

Thanks to Jesse Campos from Chef Secure

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
💎RubyGems	`actionview`	all versions	5.2.4.2`bundle update actionview --conservative`
💎RubyGems	`actionview`	≥ 6.0.0&&< 6.0.2.2	6.0.2.2`bundle update actionview --conservative`

Affected Products

4 products · 5 configurations

debian linuxdebian

1 version

8.0

fedorafedoraproject

1 version

leapopensuse

1 version

15.1

Application

actionviewrubyonrails

≥ 6.0.0 && < 6.0.2.2

range

Exploits & PoCs

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible X…

github.comNVDOct 2020

Report on openwall.com

openwall.comNVDOct 2020

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for actionview, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update actionview to 5.2.4.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2020-5267 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

Red Hat CloudForms and Satellite ship affected RubyGem actionview with methods, however, those are not vulnerable since none of those uses template string enclosed with backtick characters. A future update may fix affected RubyGem.

Product	Fixed in	Advisory
Red Hat Satellite 6.8 for RHEL 7	`ansible-collection-redhat-satellite-0:1.3.0-1.el7sat`	RHSA-2020:4366

Frequently Asked Questions

There is a possible cross site scripting (XSS) vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. ### Impact There is a possible XSS vulnerability in the `j` and `escape_javascript` methods in ActionView. These methods are used for escaping JavaScript string literals. Impacted code will look something like this: ```erb <script>let a = `<%= j unknown_input %>`</script> ``` or ```erb <script>let a = `<%= escape_javascript unknown_input %>`</script> ``` ### Releases The 6.0.2.2 and 5.2