CVE-2011-2931

actionpack Cross-site Scripting vulnerability

4.3 MediumFix available

CVE-2011-2931 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published August 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.49%, the 84th percentile. Fixed in actionpack 2.3.13.

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.

Exploit likelihood

2.49%Down 0.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2011-2931
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-2931
Updated: 2026-11-02

EUVDEUVD-2017-0310 No score

Record: EUVD-2017-0310
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v5jg-558j-q67c No score

actionpack Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.

Record: GHSA-v5jg-558j-q67c
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2011-2931
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-2931 No score

Record: DEBIAN-CVE-2011-2931
Updated: 2026-11-02

OSVGHSA-v5jg-558j-q67c No score

actionpack Cross-site Scripting vulnerability

Record: GHSA-v5jg-558j-q67c
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`actionpack` RubyGems	2.0.0 up to 2.3.13	2.3.13
`actionpack` RubyGems	3.0.0 up to 3.0.10	3.0.10
`rails` Debian:12	before 2.3.14	2.3.14
`rails` Debian:13	before 2.3.14	2.3.14
`rails` Debian:14	before 2.3.14	2.3.14
`rails` Debian:6.0	before 2.3.5-1.2+squeeze1, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.1	2.3.5-1.2+squeeze1
`rails` Debian:5.0	before 2.1.0-7+lenny1, plus listed versions 2.1.0-62.1.0-72.1.0-7+lenny0.12.1.0-7+lenny0.2	2.1.0-7+lenny1
`actionpack` RubyGems	2.0.0 up to 2.3.13, plus listed versions 2.0.12.0.22.0.42.0.52.1.0 Show 17 moreShow less 2.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.22.3.32.3.42.3.52.3.62.3.72.3.82.3.8.pre12.3.92.3.9.pre	2.3.13
`actionpack` RubyGems	3.0.0 up to 3.0.10, plus listed versions 3.0.13.0.10.rc13.0.23.0.33.0.4 Show 18 moreShow less 3.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc5	3.0.10

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less