Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-brwd-e9kx-xuc2
Vulnerability ID VCID-brwd-e9kx-xuc2
Aliases CVE-2016-2098
GHSA-78rc-8c29-p45g
Summary actionpack allows remote code execution via application's unrestricted use of render method Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
cvssv3.1 7.3 http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
generic_textual HIGH http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
epss 0.84091 https://api.first.org/data/v1/epss?cve=CVE-2016-2098
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-78rc-8c29-p45g
cvssv3.1 7.3 https://github.com/rails/rails
generic_textual HIGH https://github.com/rails/rails
cvssv3.1 7.3 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
cvssv3 7.3 https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
cvssv3.1 7.3 https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
generic_textual HIGH https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
cvssv3.1 7.3 https://nvd.nist.gov/vuln/detail/CVE-2016-2098
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2016-2098
cvssv3.1 7.3 https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
generic_textual HIGH https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
cvssv3.1 7.3 https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
generic_textual HIGH https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
cvssv3.1 7.3 https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
generic_textual HIGH https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
cvssv3.1 7.3 https://www.exploit-db.com/exploits/40086
generic_textual HIGH https://www.exploit-db.com/exploits/40086
cvssv3.1 7.3 http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
generic_textual HIGH http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
cvssv3.1 7.3 http://www.debian.org/security/2016/dsa-3509
generic_textual HIGH http://www.debian.org/security/2016/dsa-3509
Reference id Reference type URL
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2016-2098.json
https://api.first.org/data/v1/epss?cve=CVE-2016-2098
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2097
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2098
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
https://groups.google.com/forum/#!topic/ruby-security-ann/ly-IH-fxr_Q
https://nvd.nist.gov/vuln/detail/CVE-2016-2098
https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
https://www.exploit-db.com/exploits/40086
https://www.exploit-db.com/exploits/40086/
http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/
http://www.debian.org/security/2016/dsa-3509
1310054 https://bugzilla.redhat.com/show_bug.cgi?id=1310054
CVE-2016-2098 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/ruby/remote/40086.rb
GHSA-78rc-8c29-p45g https://github.com/advisories/GHSA-78rc-8c29-p45g
RHSA-2016:0454 https://access.redhat.com/errata/RHSA-2016:0454
RHSA-2016:0455 https://access.redhat.com/errata/RHSA-2016:0455
RHSA-2016:0456 https://access.redhat.com/errata/RHSA-2016:0456
Data source Exploit-DB
Date added July 11, 2016
Description Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)
Ransomware campaign use Known
Source publication date July 11, 2016
Exploit type remote
Platform ruby
Source update date July 11, 2016
Data source Metasploit
Description This module exploits a remote code execution vulnerability in the inline request processor of the Ruby on Rails ActionPack component. This vulnerability allows an attacker to process ERB to the inline JSON processor, which is then rendered, permitting full RCE within the runtime, without logging an error condition.
Note 
Reliability:
  - unknown-reliability
Stability:
  - unknown-stability
SideEffects:
  - unknown-side-effects
Ransomware campaign use Unknown
Source publication date March 1, 2016
Platform Ruby
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/rails_actionpack_inline_exec.rb
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/rails/rails
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2016-2098
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at https://www.exploit-db.com/exploits/40086
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L Found at http://www.debian.org/security/2016/dsa-3509
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99319
EPSS Score 0.84091
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T08:57:07.438561+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-78rc-8c29-p45g/GHSA-78rc-8c29-p45g.json 38.6.0