CVE-2020-8163
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
CVE-2020-8163- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
CVE-2020-8163- Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2020-0551 No score
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
EUVD-2020-0551- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cr3x-7m39-c6jq
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
GHSA-cr3x-7m39-c6jq- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
CVE-2020-8163- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8163
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
DEBIAN-CVE-2020-8163- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-cr3x-7m39-c6jq
Remote code execution via user-provided local names in ActionView
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
GHSA-cr3x-7m39-c6jq- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8163
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
UBUNTU-CVE-2020-8163- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-rails-2020-8163 No score
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
- Record
BIT-rails-2020-8163- Updated
- 2026-11-02
OSVSUSE-SU-2020:2140-1 No score
Security update for rubygem-actionview-4_2
This update for rubygem-actionview-4_2 fixes the following issues:
- Fixed a potential remote code execution of user-provided local names (bsc#1173144, CVE-2020-8163).
- Record
SUSE-SU-2020:2140-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionviewRubyGems |
through 4.2.11.1 | 4.2.11.3 |
railsBitnami |
before 5.0.1 | 5.0.1 |
railsDebian:12 |
before 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
railsDebian:13 |
before 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
railsDebian:14 |
before 2:5.2.0+dfsg-2 | 2:5.2.0+dfsg-2 |
railsDebian:9 From an advisory covering 3 CVEs |
before 2:4.2.7.1-1+deb9u3, plus listed versions 2:4.2.7.1-12:4.2.7.1-1+deb9u12:4.2.7.1-1+deb9u2 |
2:4.2.7.1-1+deb9u3 |
actionviewRubyGems |
before 4.2.11.3, plus listed versions 4.1.04.1.0.beta14.1.0.beta24.1.0.rc14.1.0.rc2 Show 45 moreShow less4.1.14.1.104.1.10.rc14.1.10.rc24.1.10.rc34.1.10.rc44.1.114.1.124.1.12.rc14.1.134.1.13.rc14.1.144.1.14.14.1.14.24.1.14.rc14.1.14.rc24.1.154.1.15.rc14.1.164.1.16.rc14.1.24.1.2.rc14.1.2.rc24.1.2.rc34.1.34.1.44.1.54.1.64.1.6.rc14.1.6.rc24.1.74.1.7.14.1.84.1.94.1.9.rc14.2.04.2.0.beta14.2.0.beta24.2.0.beta34.2.0.beta44.2.0.rc14.2.0.rc24.2.0.rc34.2.14.2.1.rc1 |
4.2.11.3 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 6-LTSS |
before 4.2.9-9.9.1 | 4.2.9-9.9.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud 6-LTSS |
before 4.2.9-7.6.1 | 4.2.9-7.6.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-9.9.1 | 4.2.9-9.9.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-activesupport-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-7.6.1 | 4.2.9-7.6.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud Crowbar 8 |
before 4.2.9-9.9.1 | 4.2.9-9.9.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud Crowbar 8 |
before 4.2.9-7.6.1 | 4.2.9-7.6.1 |
rubygem-actionview-4_2SUSE:OpenStack Cloud Crowbar 9 |
before 4.2.9-9.9.1 | 4.2.9-9.9.1 |
rubygem-activesupport-4_2SUSE:OpenStack Cloud Crowbar 9 |
before 4.2.9-7.6.1 | 4.2.9-7.6.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | lucasamorimca/CVE-2020-8163 | 2020-06-19 |
| PoC in GitHub | h4ms1k/CVE-2020-8163 | 2020-07-18 |
| Exploit-DB | Rails 5.0.1 - Remote Code Execution | 2020-07-26 |
| PoC in GitHub | RedBinaryRabbit/CVE-2020-8163 | 2022-03-24 |
| Nuclei | Ruby on Rails <5.0.1 - Remote Code Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8163 is a high vulnerability (CVSS 8.8) in Rubyonrails Rails, published July 2, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.5%, the 99th percentile. Fixed in actionview 4.2.11.3.
References
hackerone.com/reports/304805
groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0
lists.debian.org/debian-lts-announce/2020/07/msg00013.html
packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html
nvd.nist.gov/vuln/detail/CVE-2020-8163
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2020-8163
suse.com/support/update/announcement/2020/suse-su-20202140-1
bugzilla.suse.com/1173144
ubuntu.com/security/CVE-2020-8163
weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released
cve.org/CVERecord?id=CVE-2020-8163
Left out here: 28 versions. The JSON record has them.