Cross-site Scripting in actionpack
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this commit
https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4.
This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.