XSS Vulnerability in ActiveSupport Affects Ruby on Rails

CVE-2023-28120

What is CVE-2023-28120?

A security vulnerability exists in ActiveSupport where the new bytesplice method can be exploited if called on a SafeBuffer containing untrusted user input. This may lead to Cross-Site Scripting (XSS) attacks, potentially allowing an attacker to inject malicious scripts, which could be executed in the context of a user's browser session. Developers using ActiveSupport should review their input validation mechanisms and apply recommended updates to safeguard against this vulnerability.

References