CVE-2009-4214: Moderate severity vulnerability that affects rails

October 24, 2017 (updated April 9, 2025)

Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

References

github.com/advisories/GHSA-9p3v-wf2w-v29c
github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-4214.yml
nvd.nist.gov/vuln/detail/CVE-2009-4214

Code Behaviors & Features

Detect and mitigate CVE-2009-4214 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →