BREW-KRANE-CVE-2012-3464 (GHSA-H835-75HW-PJ89)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-08-13 17:01 – Source website
VLAI
Summary
activesupport Cross-site Scripting vulnerability
Details
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "activesupport",
"resource_purl": "pkg:gem/activesupport@8.1.1",
"upstream_fixed_in": "3.2.8"
},
"package": {
"ecosystem": "Homebrew",
"name": "krane",
"purl": "pkg:brew/krane"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "RubyGems",
"key": "pkg:gem/activesupport@8.1.1",
"name": "activesupport",
"resource": "activesupport",
"strategy": "registry",
"subject_version": "8.1.1"
}
]
},
"details": "Cross-site scripting (XSS) vulnerability in `activesupport/lib/active_support/core_ext/string/output_safety.rb` in Ruby on Rails before 2.3.16, 3.0.x before , 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character.",
"id": "BREW-krane-CVE-2012-3464",
"modified": "2026-08-13T17:01:45Z",
"published": "2026-08-13T17:01:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/issues/7215"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/28f2c6f4037081da0a82104a3f473165ed4ed2ce"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/780a718723cf87b49cfe204d355948c4e0932d23"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/d0c9759d3aeb6327d68dd6c0de0fe2fed4e3c870"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/d549df7133f2b0bad8112890d478c33e990e12bc"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-h835-75hw-pj89"
},
{
"type": "PACKAGE",
"url": "https://github.com/rails/rails"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2012-3464.yml"
},
{
"type": "WEB",
"url": "https://groups.google.com/group/rubyonrails-security/msg/8f1bbe1cef8c6caf?dmode=source\u0026output=gplain"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"type": "WEB",
"url": "http://weblog.rubyonrails.org/2012/8/9/ann-rails-3-2-8-has-been-released"
}
],
"schema_version": "1.7.3",
"summary": "activesupport Cross-site Scripting vulnerability",
"upstream": [
"GHSA-h835-75hw-pj89",
"CVE-2012-3464"
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…