{"id":"CVE-2020-8163","aliases":["BIT-rails-2020-8163","DEBIAN-CVE-2020-8163","DLA-2282-1","EUVD-2020-0551","GHSA-cr3x-7m39-c6jq","SUSE-SU-2020:2140-1","UBUNTU-CVE-2020-8163"],"status":"published","title":"Remote code execution via user-provided local names in ActionView","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.82465,"percentile":0.99669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-94"],"published":"2020-07-02T18:35:12Z","modified":"2026-10-26T12:02:24Z","exploits":[{"source":"pocgithub","id":"lucasamorimca/CVE-2020-8163","title":"lucasamorimca/CVE-2020-8163","date":"2020-06-19","url":"https://github.com/lucasamorimca/CVE-2020-8163"},{"source":"pocgithub","id":"h4ms1k/CVE-2020-8163","title":"h4ms1k/CVE-2020-8163","date":"2020-07-18","url":"https://github.com/h4ms1k/CVE-2020-8163"},{"source":"exploitdb","id":"EDB-48716","title":"Rails 5.0.1 - Remote Code Execution","type":"webapps","platform":"ruby","date":"2020-07-26","url":"https://www.exploit-db.com/exploits/48716"},{"source":"pocgithub","id":"RedBinaryRabbit/CVE-2020-8163","title":"RedBinaryRabbit/CVE-2020-8163","date":"2022-03-24","url":"https://github.com/RedBinaryRabbit/CVE-2020-8163"},{"source":"nuclei","id":"CVE-2020-8163","title":"Ruby on Rails \u003c5.0.1 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8163.yaml"}],"fixes":[{"ecosystem":"RubyGems","package":"actionview","fixed_in":["4.2.11.3"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rails","fixed_in":["5.0.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:5.2.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:5.2.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:5.2.0+dfsg-2"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"rubygem-actionview-4_2","fixed_in":["4.2.9-9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"rubygem-activesupport-4_2","fixed_in":["4.2.9-7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionview-4_2","fixed_in":["4.2.9-9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activesupport-4_2","fixed_in":["4.2.9-7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-actionview-4_2","fixed_in":["4.2.9-9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-activesupport-4_2","fixed_in":["4.2.9-7.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-actionview-4_2","fixed_in":["4.2.9-9.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-activesupport-4_2","fixed_in":["4.2.9-7.6.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.2.11.1"},{"fixed":"4.2.11.3"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rails","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:5.2.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:5.2.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:5.2.0+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.7.1-1+deb9u3"}]}],"versions":["2:4.2.7.1-1","2:4.2.7.1-1+deb9u1","2:4.2.7.1-1+deb9u2"],"bundled":3},{"source":"osv","ecosystem":"RubyGems","package":"actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.11.3"}]}],"versions":["4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.2","4.1.14.rc1","4.1.14.rc2","4.1.15","4.1.15.rc1","4.1.16","4.1.16.rc1","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1","4.2.0","4.2.0.beta1","4.2.0.beta2","4.2.0.beta3","4.2.0.beta4","4.2.0.rc1","4.2.0.rc2","4.2.0.rc3","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.10","4.2.10.rc1","4.2.11","4.2.11.1","4.2.11.2","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.2","4.2.5.rc1","4.2.5.rc2","4.2.6","4.2.6.rc1","4.2.7","4.2.7.1","4.2.7.rc1","4.2.8","4.2.8.rc1","4.2.9","4.2.9.rc1","4.2.9.rc2"]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6-LTSS","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rails","product":"https://github.com/rails/rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://hackerone.com/reports/304805","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory","web","report"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Third Party Advisory","web","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8163","tags":["web","advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8163.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cr3x-7m39-c6jq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8163","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202140-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173144","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8163","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-8163","tags":["report"]},{"url":"https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/","tags":["report"]},{"url":"https://github.com/rails/rails/commit/4c46a15e0a7815ca9e4cd7c7fda042eb8c1b7724","tags":["report"]},{"url":"https://github.com/rails/rails/commit/1f3db0ad793441a0c00e85d56228fc80aafbe6c1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8163","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T18:35:12Z","modified":"2024-08-04T09:48:25.683Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2020-0551","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T18:35:12Z","modified":"2024-08-04T09:48:25Z","updated_at":"2026-11-03T03:07:58.506831Z"}],"ghsa":[{"id":"GHSA-cr3x-7m39-c6jq","title":"Remote code execution via user-provided local names in ActionView","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-07T16:34:27Z","modified":"2023-07-05T20:22:41Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T19:15:12.433Z","modified":"2026-06-17T03:25:58.177Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:08.145904Z"}],"osv":[{"id":"CVE-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T19:15:12.433Z","modified":"2026-10-24T10:31:06.008128259Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T19:15:12.433Z","modified":"2026-10-26T12:02:24.258416849Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-cr3x-7m39-c6jq","title":"Remote code execution via user-provided local names in ActionView","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-07T16:34:27Z","modified":"2024-02-16T08:05:45.499862Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"UBUNTU-CVE-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2020-07-02T19:15:00Z","modified":"2026-10-17T12:56:14.635607415Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"BIT-rails-2020-8163","description":"The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.","status":"published","published":"2024-03-06T11:04:18.694Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-2282-1","title":"rails - security update","status":"published","published":"2020-07-20T00:00:00Z","modified":"2026-03-09T01:21:58.154199Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"SUSE-SU-2020:2140-1","title":"Security update for rubygem-actionview-4_2","description":"This update for rubygem-actionview-4_2 fixes the following issues:\n\n- Fixed a potential remote code execution of user-provided local names (bsc#1173144, CVE-2020-8163).\n  ","status":"published","published":"2020-08-06T09:05:11Z","modified":"2026-02-04T04:01:55.345572Z","updated_at":"2026-11-02T15:53:48.11786Z"}]}}