Every CVESearch/Get API key

CVE-2013-1855

actionpack Cross-site Scripting vulnerability

4.3 MediumFix available

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Exploit likelihood

2.63%Up 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used4.3

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
CVE-2013-1855
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
CVE-2013-1855
Updated
2026-11-02
EUVDEUVD-2017-0289No score

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
EUVD-2017-0289
Updated
2026-11-03
GitHub AdvisoriesGHSA-q759-hwvc-m3jgNo score

actionpack Cross-site Scripting vulnerability

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
GHSA-q759-hwvc-m3jg
Weakness
CWE-79
Updated
2026-11-02
OSVNo score

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
CVE-2013-1855
Updated
2026-11-02
OSVDEBIAN-CVE-2013-1855No score

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
DEBIAN-CVE-2013-1855
Updated
2026-11-02
OSVGHSA-q759-hwvc-m3jgNo score

actionpack Cross-site Scripting vulnerability

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record
GHSA-q759-hwvc-m3jg
Weakness
CWE-79
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
before 2.3.18
2.3.18
actionpack
RubyGems
3.0.0 up to 3.1.12
3.1.12
actionpack
RubyGems
3.2.0 up to 3.2.13
3.2.13
rails
Debian:12
before 2.3.14.1
2.3.14.1
rails
Debian:13
before 2.3.14.1
2.3.14.1
rails
Debian:14
before 2.3.14.1
2.3.14.1
rails
Debian:6.0
From an advisory covering 6 CVEs
before 2.3.5-1.2+squeeze8, plus listed versions
2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3
Show 5 moreShow less
2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7
2.3.5-1.2+squeeze8
actionpack
RubyGems
before 2.3.18, plus listed versions
0.9.00.9.51.0.01.0.11.1.0
Show 45 moreShow less
1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.15
2.3.18
actionpack
RubyGems
3.0.0 up to 3.1.12, plus listed versions
3.0.13.0.103.0.10.rc13.0.113.0.12
Show 45 moreShow less
3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10
3.1.12
actionpack
RubyGems
3.2.0 up to 3.2.13, plus listed versions
3.2.13.2.103.2.113.2.123.2.13.rc1
Show 19 moreShow less
3.2.13.rc23.2.23.2.2.rc13.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc3
3.2.13
ruby193-rubygem-actionpack
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
before 1:3.2.8-5.el6
1:3.2.8-5.el6
ruby193-rubygem-actionpack-doc
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
before 1:3.2.8-5.el6
1:3.2.8-5.el6
rubygem-actionpack
Red Hat:openshift:1::el6
From an advisory covering 2 CVEs
before 1:3.0.13-8.el6op
1:3.0.13-8.el6op

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1855 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published March 19, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in actionpack 2.3.18.

References

Show 21 moreShow less
This page doesn't list everything

Left out here: 25 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open