{"action":"Upgrade actionview to 6.1.7.3 or later.","affected":[{"fixed":"6.1.7.3","introduced":"5.1.0"},{"fixed":"7.0.4.3","introduced":"7.0.0"}],"component":"actionview","cve_ids":["CVE-2023-23913"],"ecosystem":"RubyGems","epss":0.00639,"exploited":false,"fixed_versions":["6.1.7.3","7.0.4.3"],"ghsa_id":"GHSA-xp5h-f8jf-rc8q","id":"tcs_01M5KEPAA1X3YNSXPN3SMEAA2Z","modified_at":"2025-01-09T19:12:08.012257Z","published_at":"2023-06-09T22:41:16Z","references":["https://osv.dev/vulnerability/GHSA-xp5h-f8jf-rc8q","https://nvd.nist.gov/vuln/detail/CVE-2023-23913","https://github.com/rails/rails/commit/5037a13614d71727af8a175063bcf6ba1a74bdbd","https://github.com/rails/rails/commit/73009ea59a811b28e8ec2a9c9bc24635aa891214","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033263","https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468","https://github.com/rails/rails","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2023-23913.yml","https://security.netapp.com/advisory/ntap-20240605-0007","https://www.debian.org/security/2023/dsa-5389"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-xp5h-f8jf-rc8q","url":"https://osv.dev/vulnerability/GHSA-xp5h-f8jf-rc8q"}],"summary":"rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements"}