TI-2023-27670 Aliases CVE-2023-50724 GHSA-r8xx-8vm8-x6wj

Resque vulnerable to reflected cross site scripting through pathname

LOW 29CWE-79Published 2023-12-21 · Updated 2024-08-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Resque (pronounced like "rescue") is a Redis-backed library for creating background jobs, placing those jobs on multiple queues, and processing them later. resque-web in resque versions before 2.1.0 are vulnerable to reflected XSS through the current_queue parameter in the path of the queues endpoint. This issue has been patched in version 2.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00484 41st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed resque (resque): 2.1.0resque (RubyGems): 2.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
resque	resque	before 2.1.0	2.1.0	Patch available	CNA
—	resque (RubyGems)	before 2.1.0	2.1.0	Patch available	GHSA-r8xx-8vm8-x6wj

resque Vendorresque Affected before 2.1.0 Fixed in 2.1.0 Patch available CNA
resque (RubyGems) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-r8xx-8vm8-x6wj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:resque:resque::::::ruby::*	before 2.1.0	Vulnerable	resque

cpe:2.3:a:resque:resque:*:*:*:*:*:ruby:*:* Versions before 2.1.0 Vulnerable ·resque

Remediation

Fix · CNA resque (resque) Fixed in 2.1.0
Fix · GHSA-r8xx-8vm8-x6wj resque (RubyGems) Fixed in 2.1.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-50724
2026-10-03 Alias added: GHSA-r8xx-8vm8-x6wj

References

Exploit 1

https://github.com/resque/resque/issues/1679

Patch 1

https://github.com/resque/resque/pull/1687

Advisory 2

Other 3

TI-2023-27673 Resque vulnerable to reflected XSS in Queue Endpoint CVSS 3.1MEDIUM 6.3
TI-2023-27671 Resque vulnerable to reflected XSS in resque-web failed and queues lists CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences