Read the docs
TI-2015-02855 Aliases CVE-2015-3226GHSA-vxvp-4xwc-jpp6

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on…

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.

Why it matters now

EPSS 0.0276 86th percentileScored 2026-11-07
Fix Partial activesupport (RubyGems): 4.1.11, 4.2.2Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—activesupport (RubyGems)4.1.0 to before 4.1.114.1.11Patch availableGHSA-vxvp-4xwc-jpp6
—activesupport (RubyGems)4.2.0 to before 4.2.24.2.2Patch availableGHSA-vxvp-4xwc-jpp6
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • activesupport (RubyGems) Vendor— Affected 4.1.0 to before 4.1.11 Fixed in 4.1.11 Patch available GHSA-vxvp-4xwc-jpp6
  • activesupport (RubyGems) Vendor— Affected 4.2.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-vxvp-4xwc-jpp6

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*3.2.7VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·Rails
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*3.2.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*3.2.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*3.2.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*3.2.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*3.2.12VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*3.2.13VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*3.2.15VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*3.2.16VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*3.2.17VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.0:*:*:*:*:*:*:*4.1.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*4.1.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*4.1.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*4.1.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*4.1.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*4.1.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*4.1.7VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*4.1.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*4.2.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*4.2.1VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*3.2.14VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:* Versions 3.2.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:* Versions 3.2.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:* Versions 3.2.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:* Versions 3.2.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:* Versions 3.2.13 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:* Versions 3.2.15 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:* Versions 3.2.16 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:* Versions 3.2.17 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:* Versions 4.1.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:* Versions 4.1.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:* Versions 3.2.14 Vulnerable ·Rails

Remediation

  • Fix · GHSA-vxvp-4xwc-jpp6 activesupport (RubyGems) Fixed in 4.1.11 Advisory →
  • Fix · GHSA-vxvp-4xwc-jpp6 activesupport (RubyGems) Fixed in 4.2.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Not affected: 1 product
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-3226
  2. 2026-10-03 Alias added: GHSA-vxvp-4xwc-jpp6

References

Advisory 3

Other 5

  • TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
  • TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
  • TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
  • TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
  • TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
See all 117 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences