CVE-2020-8264
Cross-site scripting in actionpack
CVE-2020-8264 is a medium vulnerability (CVSS 6.1) in Rails Https://github.com/rails/rails, published January 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 67.0%, the 99th percentile. Fixed in actionpack 6.0.3.4.
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Record
CVE-2020-8264- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Record
CVE-2020-8264- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-0742 No score
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Record
EUVD-2021-0742- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35mm-cc6r-8fjp
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: config.middleware.delete ActionDispatch::ActionableExceptions
- Record
GHSA-35mm-cc6r-8fjp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Record
CVE-2020-8264- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8264
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
- Record
DEBIAN-CVE-2020-8264- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 27 moreShow less
OSVGHSA-35mm-cc6r-8fjp
Cross-site scripting in actionpack
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: config.middleware.delete ActionDispatch::ActionableExceptions
- Record
GHSA-35mm-cc6r-8fjp- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11313-1 No score
ruby2.7-rubygem-actioncable-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actioncable-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11313-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11314-1 No score
ruby2.7-rubygem-actionmailbox-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actionmailbox-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11314-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11316-1 No score
ruby2.7-rubygem-actionmailer-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actionmailer-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11316-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11318-1 No score
ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11318-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11319-1 No score
ruby2.7-rubygem-actiontext-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actiontext-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11319-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11321-1 No score
ruby2.7-rubygem-actionview-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-actionview-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11321-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11323-1 No score
ruby2.7-rubygem-activejob-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activejob-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11323-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11325-1 No score
ruby2.7-rubygem-activemodel-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activemodel-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11325-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11327-1 No score
ruby2.7-rubygem-activerecord-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activerecord-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11327-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11329-1 No score
ruby2.7-rubygem-activestorage-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activestorage-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11329-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11331-1 No score
ruby2.7-rubygem-activesupport-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activesupport-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11331-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11348-1 No score
ruby2.7-rubygem-rails-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rails-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11348-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11351-1 No score
ruby2.7-rubygem-railties-6.0-6.0.4-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-railties-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11351-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11818-1 No score
ruby3.1-rubygem-actioncable-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actioncable-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11818-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11819-1 No score
ruby3.1-rubygem-actionmailbox-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actionmailbox-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11819-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11820-1 No score
ruby3.1-rubygem-actionmailer-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actionmailer-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11820-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11821-1 No score
ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11821-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11822-1 No score
ruby3.1-rubygem-actiontext-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actiontext-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11822-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11823-1 No score
ruby3.1-rubygem-actionview-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-actionview-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11823-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11824-1 No score
ruby3.1-rubygem-activejob-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activejob-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11824-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11825-1 No score
ruby3.1-rubygem-activemodel-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activemodel-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11825-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11826-1 No score
ruby3.1-rubygem-activerecord-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activerecord-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11826-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11827-1 No score
ruby3.1-rubygem-activestorage-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activestorage-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11827-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11828-1 No score
ruby3.1-rubygem-activesupport-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-activesupport-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11828-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11831-1 No score
ruby3.1-rubygem-rails-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rails-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11831-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11832-1 No score
ruby3.1-rubygem-railties-6.0-6.0.4.4-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-railties-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11832-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
6.0.0 to 6.0.3.3 | 6.0.3.4 |
railsDebian:12 |
before 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
railsDebian:13 |
before 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
railsDebian:14 |
before 2:6.0.3.4+dfsg-1 | 2:6.0.3.4+dfsg-1 |
actionpackRubyGems |
6.0.0 up to 6.0.3.4, plus listed versions 6.0.16.0.1.rc16.0.26.0.2.16.0.2.2 Show 7 moreShow less6.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.rc1 |
6.0.3.4 |
rubygem-actioncable-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-actionmailbox-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-actionmailer-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-actionpack-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-actiontext-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-actionview-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-activejob-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-activemodel-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-activerecord-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-activestorage-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-activesupport-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-rails-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
rubygem-railties-6.0openSUSE:Tumbleweed |
before 6.0.4.4-1.1 | 6.0.4.4-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases, products | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
hackerone.com/reports/904059
groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
nvd.nist.gov/vuln/detail/CVE-2020-8264
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
Show 18 moreShow less
security-tracker.debian.org/tracker/CVE-2020-8264
suse.com/security/cve/CVE-2019-5418