{"action":"Upgrade activesupport to 4.1.11 or later.","affected":[{"fixed":"4.1.11","introduced":"4.1.0"},{"fixed":"4.2.2","introduced":"4.2.0"}],"component":"activesupport","cve_ids":["CVE-2015-3226"],"ecosystem":"RubyGems","epss":0.0278,"exploited":false,"fixed_versions":["4.1.11","4.2.2"],"ghsa_id":"GHSA-vxvp-4xwc-jpp6","id":"tcs_01M5KENR8YSA0KXK12CWB3H202","modified_at":"2025-11-04T21:04:17.912261Z","published_at":"2017-10-24T18:33:36Z","references":["https://osv.dev/vulnerability/GHSA-vxvp-4xwc-jpp6","https://nvd.nist.gov/vuln/detail/CVE-2015-3226","https://github.com/rails/rails","https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ","https://groups.google.com/g/rubyonrails-core/c/qBUqVlXERag/m/kuH3wQk1kxUJ","https://web.archive.org/web/20200228033946/http://www.securityfocus.com/bid/75231","https://web.archive.org/web/20200517005133/http://www.securitytracker.com/id/1033755","http://openwall.com/lists/oss-security/2015/06/16/17","http://www.debian.org/security/2016/dsa-3464"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-vxvp-4xwc-jpp6","url":"https://osv.dev/vulnerability/GHSA-vxvp-4xwc-jpp6"}],"summary":"activesupport Cross-site Scripting vulnerability"}