CVE-2023-50725
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
- Record
CVE-2023-50725- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-3207
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
- Record
EUVD-2023-3207- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc3j-vvwf-4rp8
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Impact
The following paths in resque-web have been found to be vulnerable to reflected XSS:
/failed/?class=<script>alert(document.cookie)</script>
/queues/><img src=a onerror=alert(document.cookie)>
Patches
v2.2.1
Workarounds
No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.
References
- Record
GHSA-gc3j-vvwf-4rp8- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79, CWE-233
- Updated
- 2026-11-02
NVD
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
- Record
CVE-2023-50725- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: "/failed/?class=<script>alert(document.cookie)</script>" and "/queues/><img src=a onerror=alert(document.cookie)>". This issue has been patched in version 2.2.1.
- Record
CVE-2023-50725- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-gc3j-vvwf-4rp8
Resque vulnerable to reflected XSS in resque-web failed and queues lists
Impact
The following paths in resque-web have been found to be vulnerable to reflected XSS:
/failed/?class=<script>alert(document.cookie)</script>
/queues/><img src=a onerror=alert(document.cookie)>
Patches
v2.2.1
Workarounds
No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.
References
- Record
GHSA-gc3j-vvwf-4rp8- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N - Weakness
- CWE-233, CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
resqueRubyGems |
before 2.2.1 | 2.2.1 |
resqueRubyGems |
before 2.2.1, plus listed versions 0.2.01.0.01.1.01.10.01.11.0 Show 45 moreShow less1.12.01.13.01.14.01.15.01.16.01.16.11.17.01.17.11.18.01.18.11.18.21.18.31.18.41.18.51.18.61.19.01.2.01.2.11.2.31.20.01.21.01.22.01.23.01.23.11.24.01.24.11.25.01.25.0.pre1.25.11.25.21.26.01.26.pre.01.27.01.27.11.27.21.27.31.27.41.3.01.3.11.4.01.5.01.5.11.5.21.6.01.6.1 |
2.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-50725 is a medium vulnerability (CVSS 6.3) in Resque, published December 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in resque 2.2.1.
References
github.com/resque/resque/security/advisories/GHSA-gc3j-vvwf-4rp8
nvd.nist.gov/vuln/detail/CVE-2023-50725
Left out here: 22 versions. The JSON record has them.