CVE-2011-0446
Rails actionpack gem vulnerable to Cross-site Scripting
CVE-2011-0446 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published February 14, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in actionpack 2.3.11.
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- Updated
- 2026-11-02
EUVDEUVD-2017-0182 No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
EUVD-2017-0182- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-75w6-p6mg-vh8j No score
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
GHSA-75w6-p6mg-vh8j- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
CVE-2011-0446- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-0446 No score
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
DEBIAN-CVE-2011-0446- Updated
- 2026-11-02
OSVGHSA-75w6-p6mg-vh8j No score
Rails actionpack gem vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
- Record
GHSA-75w6-p6mg-vh8j- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
before 2.3.11 | 2.3.11 |
actionpackRubyGems |
3.0.0 up to 3.0.4 | 3.0.4 |
actionviewRubyGems |
before 2.3.11 | 2.3.11 |
actionviewRubyGems |
3.0.0 up to 3.0.4 | 3.0.4 |
railsDebian:12 |
before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:13 |
before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:14 |
before 2.3.11-0.1 | 2.3.11-0.1 |
railsDebian:6.0 |
before 2.3.5-1.2+squeeze0.1, plus listed versions 2.3.5-1.2 |
2.3.5-1.2+squeeze0.1 |
railsDebian:5.0 |
before 2.1.0-7+lenny0.1, plus listed versions 2.1.0-62.1.0-7 |
2.1.0-7+lenny0.1 |
actionpackRubyGems |
before 2.3.11, plus listed versions 0.9.00.9.51.0.01.0.11.1.0 Show 45 moreShow less1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.22.3.32.3.42.3.5 |
2.3.11 |
actionpackRubyGems |
3.0.0 up to 3.0.4, plus listed versions 3.0.13.0.23.0.33.0.4.rc1 |
3.0.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
vupen.com/english/advisories/2011/0587
lists.fedoraproject.org/pipermail/package-announce/2011-March/055088.html
securityfocus.com/bid/46291
debian.org/security/2011/dsa-2247
secunia.com/advisories/43274
Show 18 moreShow less
securitytracker.com/id?1025064
groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain
nvd.nist.gov/vuln/detail/CVE-2011-0446
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2011-0446.yml
web.archive.org/web/20120527023027/http://www.securityfocus.com/bid/46291
security-tracker.debian.org/tracker/CVE-2011-0446
Left out here: 6 versions. The JSON record has them.