Moderate severityNVD Advisory· Published Dec 7, 2009· Updated Jun 16, 2026
CVE-2009-4214
CVE-2009-4214
Description
Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
railsRubyGems | < 2.2.2 | 2.2.2 |
railsRubyGems | >= 2.3.0, < 2.3.5 | 2.3.5 |
Affected products
56cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*+ 43 more
- cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*
cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*range: <=2.1.2
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
18- github.com/rails/rails/commit/bfe032858077bb2946abe25e95e485ba6da86bd5nvdPatchWEB
- www.securityfocus.com/bid/37142nvdPatchWEB
- www.vupen.com/english/advisories/2009/3352nvdPatchVendor AdvisoryWEB
- secunia.com/advisories/37446nvdVendor AdvisoryWEB
- secunia.com/advisories/38915nvdVendor AdvisoryWEB
- github.com/advisories/GHSA-9p3v-wf2w-v29cghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2009-4214ghsaADVISORY
- groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0abnvdWEB
- lists.apple.com/archives/security-announce/2010//Mar/msg00001.htmlnvdWEB
- lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlnvdWEB
- support.apple.com/kb/HT4077nvdWEB
- weblog.rubyonrails.org/2009/11/30/ruby-on-rails-2-3-5-releasednvdWEB
- www.debian.org/security/2011/dsa-2260nvdWEB
- www.debian.org/security/2011/dsa-2301nvdWEB
- www.openwall.com/lists/oss-security/2009/11/27/2nvdWEB
- www.openwall.com/lists/oss-security/2009/12/08/3nvdWEB
- www.securitytracker.com/idnvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2009-4214.ymlghsaWEB
News mentions
0No linked articles in our index yet.