{"id":"CVE-2021-39197","aliases":["GHSA-w3j4-76qw-wwjm"],"url":"https://o3.security/vulnerability/CVE-2021-39197","summary":"Older releases of better_errors open to Cross-Site Request Forgery attack","details":"### Impact\nbetter_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct \"Content-Type\" header for these requests, which allowed a cross-origin \"simple request\" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks.\n\n_As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent)._\n\n### Patches\nStarting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to \"~> 2.8.3\".\n\n### Workarounds\nThere are no known workarounds to mitigate the risk of using older releases of better_errors.\n\n### References\n- Chris Moberly provided [an example attack that uses a now-patched vulnerability of webpack-dev-server in conjunction with Better Errors](https://about.gitlab.com/blog/2021/09/07/why-are-developers-vulnerable-to-driveby-attacks/)\n\n### For more information\nIf you have any questions or comments about this advisory, please\n- Add to the [discussion in better_errors](https://github.com/BetterErrors/better_errors/discussions/507)\n- Open an issue in [better_errors](https://github.com/BetterErrors/better_errors)\n","published":"2021-09-07T18:15:07.473Z","modified":"2026-07-09T11:24:36.247600Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"better_errors","fixedVersion":"2.8.0"}],"fix":{"url":"https://github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8a3fc6df2089bb0","label":"BetterErrors/better_errors@8e8e796"},"references":[{"type":"ADVISORY","url":"https://github.com/BetterErrors/better_errors/discussions/507"},{"type":"ADVISORY","url":"https://github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qw-wwjm"},{"type":"FIX","url":"https://github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8a3fc6df2089bb0"},{"type":"FIX","url":"https://github.com/BetterErrors/better_errors/pull/474"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-39197"},{"type":"PACKAGE","url":"https://github.com/BetterErrors/better_errors"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/better_errors/CVE-2021-39197.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-09T11:24:36.247600Z"}}