XSS Vulnerability in ActiveSupport Affects Ruby on Rails
CVE-2023-28120

Currently unrated

Key Information:

Vendor: Rails
Status: Activesupport
Vendor: CVE Published:; 9 January 2025

What is CVE-2023-28120?

A security vulnerability exists in ActiveSupport where the new bytesplice method can be exploited if called on a SafeBuffer containing untrusted user input. This may lead to Cross-Site Scripting (XSS) attacks, potentially allowing an attacker to inject malicious scripts, which could be executed in the context of a user's browser session. Developers using ActiveSupport should review their input validation mechanisms and apply recommended updates to safeguard against this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch