Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-4key-48mr-13f4
Vulnerability ID VCID-4key-48mr-13f4
Aliases CVE-2012-6684
GHSA-r23g-3qw4-gfh2
OSV-115941
Summary Textile Link Parsing XSS RedCloth Gem for Ruby contains a flaw that allows a cross-site scripting (XSS) attack. This flaw exists because the program does not validate input when parsing textile links before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00593 https://api.first.org/data/v1/epss?cve=CVE-2012-6684
generic_textual MODERATE https://co3k.org/blog/redcloth-unfixed-xss-en
generic_textual MODERATE http://seclists.org/fulldisclosure/2014/Dec/50
generic_textual MODERATE https://gist.github.com/co3k/75b3cb416c342aa1414c
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-r23g-3qw4-gfh2
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2012-6684.yml
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2012-6684
generic_textual MODERATE https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
generic_textual MODERATE http://www.debian.org/security/2015/dsa-3168
Reference id Reference type URL
http://co3k.org/blog/redcloth-unfixed-xss-en
https://api.first.org/data/v1/epss?cve=CVE-2012-6684
https://bugs.debian.org/774748
https://co3k.org/blog/redcloth-unfixed-xss-en
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6684
http://seclists.org/fulldisclosure/2014/Dec/50
https://gist.github.com/co3k/75b3cb416c342aa1414c
https://github.com/jgarber/redcloth/commit/2f6dab4d6aea5cee778d2f37a135637fe3f1573c
https://web.archive.org/web/20150128115714/http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss
http://www.debian.org/security/2015/dsa-3168
774748 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774748
CVE-2012-6684 https://nvd.nist.gov/vuln/detail/CVE-2012-6684
CVE-2012-6684.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/RedCloth/CVE-2012-6684.yml
GHSA-r23g-3qw4-gfh2 https://github.com/advisories/GHSA-r23g-3qw4-gfh2
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.69587
EPSS Score 0.00593
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T20:52:12.102795+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/RedCloth/CVE-2012-6684.yml 38.6.0