Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zy7d-3db6-sydw
Vulnerability ID VCID-zy7d-3db6-sydw
Aliases CVE-2020-8264
GHSA-35mm-cc6r-8fjp
Summary Cross-site scripting in actionpack In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. Workarounds ----------- Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
Status Published
Exploitability 0.5
Weighted Severity 6.9
Risk 3.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8264.json
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
epss 0.00346 https://api.first.org/data/v1/epss?cve=CVE-2020-8264
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-35mm-cc6r-8fjp
cvssv3.1 6.1 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
cvssv3 6.1 https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
cvssv3.1 6.1 https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
generic_textual MODERATE https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
cvssv3.1 6.1 https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
generic_textual MODERATE https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
cvssv3.1 6.1 https://hackerone.com/reports/904059
generic_textual MODERATE https://hackerone.com/reports/904059
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2020-8264
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-8264
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8264.json
https://api.first.org/data/v1/epss?cve=CVE-2020-8264
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8264
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
https://hackerone.com/reports/904059
https://nvd.nist.gov/vuln/detail/CVE-2020-8264
1886554 https://bugzilla.redhat.com/show_bug.cgi?id=1886554
971988 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971988
GHSA-35mm-cc6r-8fjp https://github.com/advisories/GHSA-35mm-cc6r-8fjp
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8264.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://hackerone.com/reports/904059
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-8264
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.57065
EPSS Score 0.00346
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:00:52.380300+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-35mm-cc6r-8fjp/GHSA-35mm-cc6r-8fjp.json 38.0.0