CVE-2009-4214
Moderate severity vulnerability that affects rails
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
CVE-2009-4214- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
CVE-2009-4214- Updated
- 2026-11-02
EUVDEUVD-2017-0207 No score
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
EUVD-2017-0207- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9p3v-wf2w-v29c No score
Moderate severity vulnerability that affects rails
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
GHSA-9p3v-wf2w-v29c- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
CVE-2009-4214- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-4214 No score
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
DEBIAN-CVE-2009-4214- Updated
- 2026-11-02
OSVGHSA-9p3v-wf2w-v29c No score
Moderate severity vulnerability that affects rails
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
- Record
GHSA-9p3v-wf2w-v29c- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
railsRubyGems |
before 2.2.2 | 2.2.2 |
railsRubyGems |
2.3.0 up to 2.3.5 | 2.3.5 |
railsDebian:12 |
before 2.2.3-2 | 2.2.3-2 |
railsDebian:13 |
before 2.2.3-2 | 2.2.3-2 |
railsDebian:14 |
before 2.2.3-2 | 2.2.3-2 |
railsDebian:5.0 From an advisory covering 2 CVEs |
before 2.1.0-7+lenny0.2, plus listed versions 2.1.0-62.1.0-72.1.0-7+lenny0.1 |
2.1.0-7+lenny0.2 |
railsDebian:6.0 From an advisory covering 4 CVEs |
before 2.3.5-1.2+squeeze1, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.1 |
2.3.5-1.2+squeeze1 |
railsDebian:5.0 From an advisory covering 4 CVEs |
before 2.1.0-7+lenny1, plus listed versions 2.1.0-62.1.0-72.1.0-7+lenny0.12.1.0-7+lenny0.2 |
2.1.0-7+lenny1 |
railsRubyGems |
before 2.2.2, plus listed versions 0.10.00.10.10.11.00.11.10.12.0 Show 39 moreShow less0.12.10.13.00.13.10.14.10.14.20.14.30.14.40.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.51.2.62.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.2 |
2.2.2 |
railsRubyGems |
2.3.0 up to 2.3.5, plus listed versions 2.3.22.3.32.3.4 |
2.3.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4214 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published December 7, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.02%, the 87th percentile. Fixed in rails 2.2.2.
References
groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1
secunia.com/advisories/37446
vupen.com/english/advisories/2009/3352
debian.org/security/2011/dsa-2301
lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-released
Show 14 moreShow less
securityfocus.com/bid/37142
openwall.com/lists/oss-security/2009/11/27/2
lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
support.apple.com/kb/HT4077
securitytracker.com/id?1023245
github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5
nvd.nist.gov/vuln/detail/CVE-2009-4214
security-tracker.debian.org/tracker/CVE-2009-4214