GHSA-ch3h-j2vf-95pv is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in actionview. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for actionview — see the affected versions and patch details below.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
actionview💎actionview💎actionview💎actionviewReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.
Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.
Impacted code will look something like this:
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
Where the "malicious_input" variable contains untrusted data.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Escape the untrusted data before using it as a key for tag helper methods.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | actionview | all versions | 5.2.7.1bundle update actionview --conservative |
| 💎RubyGems | actionview | ≥ 6.0.0&&< 6.0.4.8 | 6.0.4.8bundle update actionview --conservative |
| 💎RubyGems | actionview | ≥ 6.1.0&&< 6.1.5.1 | 6.1.5.1bundle update actionview --conservative |
| 💎RubyGems | actionview | ≥ 7.0.0&&< 7.0.2.4 | 7.0.2.4bundle update actionview --conservative |
Affected Products
debian linuxdebianactionpackrubyonrailsResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for actionview, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update actionview to 5.2.7.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-ch3h-j2vf-95pv is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat Satellite 6.13 for RHEL 8 | tfm-rubygem-actionview-0:6.1.7-1.el8sat | RHSA-2023:2097 |
Frequently Asked Questions
Is GHSA-ch3h-j2vf-95pv in your dependencies?
Find it across RubyGems, including transitive dependencies.