CVE-2013-1857
actionpack Cross-site Scripting vulnerability
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
Exploit likelihood
What each source reports
NVD Score used
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
CVE-2013-1857- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
CVE-2013-1857- Updated
- 2026-11-02
EUVDEUVD-2017-0258 No score
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
EUVD-2017-0258- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j838-vfpq-fmf2 No score
actionpack Cross-site Scripting vulnerability
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
GHSA-j838-vfpq-fmf2- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
CVE-2013-1857- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1857 No score
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
DEBIAN-CVE-2013-1857- Updated
- 2026-11-02
OSVGHSA-j838-vfpq-fmf2 No score
actionpack Cross-site Scripting vulnerability
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
- Record
GHSA-j838-vfpq-fmf2- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionpackRubyGems |
before 2.3.18 | 2.3.18 |
actionpackRubyGems |
3.0.0 up to 3.1.12 | 3.1.12 |
actionpackRubyGems |
3.2.0 up to 3.2.13 | 3.2.13 |
railsDebian:12 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:13 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:14 |
before 2.3.14.1 | 2.3.14.1 |
railsDebian:6.0 |
before 2.3.5-1.2+squeeze8, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3 Show 5 moreShow less2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7 |
2.3.5-1.2+squeeze8 |
actionpackRubyGems |
before 2.3.18, plus listed versions 0.9.00.9.51.0.01.0.11.1.0 Show 45 moreShow less1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.15 |
2.3.18 |
actionpackRubyGems |
3.0.0 up to 3.1.12, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10 |
3.1.12 |
actionpackRubyGems |
3.2.0 up to 3.2.13, plus listed versions 3.2.13.2.103.2.113.2.123.2.13.rc1 Show 19 moreShow less3.2.13.rc23.2.23.2.2.rc13.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc3 |
3.2.13 |
ruby193-rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.2.8-5.el6 | 1:3.2.8-5.el6 |
ruby193-rubygem-actionpack-docRed Hat:openshift:1::el6 |
before 1:3.2.8-5.el6 | 1:3.2.8-5.el6 |
rubygem-actionpackRed Hat:openshift:1::el6 |
before 1:3.0.13-8.el6op | 1:3.0.13-8.el6op |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1857 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published March 19, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.85%, the 79th percentile. Fixed in actionpack 2.3.18.
References
lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
lists.opensuse.org/opensuse-updates/2014-01/msg00013.html
support.apple.com/kb/HT5784
rhn.redhat.com/errata/RHSA-2013-0698.html
Show 20 moreShow less
groups.google.com/group/rubyonrails-security/msg/78b9817a5943f6d6?dmode=source&output=gplain
weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released
nvd.nist.gov/vuln/detail/CVE-2013-1857
web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
github.com/advisories/GHSA-j838-vfpq-fmf2
security-tracker.debian.org/tracker/CVE-2013-1857
access.redhat.com/errata/RHSA-2013:0698
bugzilla.redhat.com/show_bug.cgi?id=921331
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0698.json
cve.org/CVERecord?id=CVE-2013-1855
Left out here: 25 versions. The JSON record has them.