CVE-2013-1855

actionpack Cross-site Scripting vulnerability

4.3 MediumFix available

CVE-2013-1855 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published March 19, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. Fixed in actionpack 2.3.18.

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Exploit likelihood

2.63%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2013-1855
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-1855
Updated: 2026-11-02

EUVDEUVD-2017-0289 No score

Record: EUVD-2017-0289
Updated: 2026-11-03

GitHub AdvisoriesGHSA-q759-hwvc-m3jg No score

actionpack Cross-site Scripting vulnerability

The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.

Record: GHSA-q759-hwvc-m3jg
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2013-1855
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-1855 No score

Record: DEBIAN-CVE-2013-1855
Updated: 2026-11-02

OSVGHSA-q759-hwvc-m3jg No score

actionpack Cross-site Scripting vulnerability

Record: GHSA-q759-hwvc-m3jg
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`actionpack` RubyGems	before 2.3.18	2.3.18
`actionpack` RubyGems	3.0.0 up to 3.1.12	3.1.12
`actionpack` RubyGems	3.2.0 up to 3.2.13	3.2.13
`rails` Debian:12	before 2.3.14.1	2.3.14.1
`rails` Debian:13	before 2.3.14.1	2.3.14.1
`rails` Debian:14	before 2.3.14.1	2.3.14.1
`rails` Debian:6.0	before 2.3.5-1.2+squeeze8, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3 Show 5 moreShow less 2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze62.3.5-1.2+squeeze7	2.3.5-1.2+squeeze8
`actionpack` RubyGems	before 2.3.18, plus listed versions 0.9.00.9.51.0.01.0.11.1.0 Show 45 moreShow less 1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.15	2.3.18
`actionpack` RubyGems	3.0.0 up to 3.1.12, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less 3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10	3.1.12
`actionpack` RubyGems	3.2.0 up to 3.2.13, plus listed versions 3.2.13.2.103.2.113.2.123.2.13.rc1 Show 19 moreShow less 3.2.13.rc23.2.23.2.2.rc13.2.33.2.3.rc13.2.3.rc23.2.43.2.4.rc13.2.53.2.63.2.73.2.7.rc13.2.83.2.8.rc13.2.8.rc23.2.93.2.9.rc13.2.9.rc23.2.9.rc3	3.2.13
`ruby193-rubygem-actionpack` Red Hat:openshift:1::el6	before 1:3.2.8-5.el6	1:3.2.8-5.el6
`ruby193-rubygem-actionpack-doc` Red Hat:openshift:1::el6	before 1:3.2.8-5.el6	1:3.2.8-5.el6
`rubygem-actionpack` Red Hat:openshift:1::el6	before 1:3.0.13-8.el6op	1:3.0.13-8.el6op