CVE-2013-6416

actionpack Cross-site Scripting vulnerability

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

Exploit likelihood

1.96%Up 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-6416
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-6416
Updated: 2026-11-02

EUVDEUVD-2017-0319 No score

Record: EUVD-2017-0319
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w37c-q653-qg95 No score

actionpack Cross-site Scripting vulnerability

Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.

Record: GHSA-w37c-q653-qg95
Weakness: CWE-79
Updated: 2026-11-02

OSVGHSA-w37c-q653-qg95 No score

actionpack Cross-site Scripting vulnerability

Record: GHSA-w37c-q653-qg95
Weakness: CWE-79
Updated: 2026-11-02

Affected products

rubyonrails rails

Affected packages

Affected packages
Package	Affected	Fixed
`actionpack` RubyGems	4.0.0 up to 4.0.2	4.0.2
`actionpack` RubyGems	4.0.0 up to 4.0.2, plus listed versions 4.0.14.0.1.rc14.0.1.rc24.0.1.rc34.0.1.rc4	4.0.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6416 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published December 7, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.96%, the 80th percentile. Fixed in actionpack 4.0.2.

References

Show 4 moreShow less