Moderate severityNVD Advisory· Published Aug 29, 2011· Updated Apr 29, 2026

CVE-2011-2931

Description

Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Cross-site scripting vulnerability in Ruby on Rails strip_tags helper allows injection via invalid tag names, affecting versions before 2.3.13, 3.0.10, and 3.1.0.rc5.

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the strip_tags helper located in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails. The flaw allows remote attackers to inject arbitrary web script or HTML by providing a tag with an invalid name that bypasses the sanitization logic. Affected versions are all prior to 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request containing a tag with an invalid name to any application using the vulnerable strip_tags helper. No authentication or special privileges are required; the attacker only needs network access to the target application. The malicious input is processed by the helper, which fails to properly sanitize the invalid tag, allowing the injected script or HTML to be rendered in the browser of a victim user [1].

Impact

Successful exploitation results in arbitrary web script or HTML execution in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information, depending on the attacker's payload. The impact is limited to the client-side, but can affect any user who views the attacker-controlled content [1].

Mitigation

The vulnerability is fixed in Rails versions 2.3.13, 3.0.10, and 3.1.0.rc5. Users should upgrade to these or later versions immediately. No workarounds are documented in the available references. If upgrading is not possible, consider disabling the use of strip_tags or applying additional input validation [1].

References

NVD - CVE-2011-2931

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
actionpackRubyGems	>= 2.0.0, < 2.3.13	2.3.13
actionpackRubyGems	>= 3.0.0, < 3.0.10	3.0.10

Affected products

Rubyonrails/Rails58 versions
cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*+ 57 more
- cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*
Rubyonrails/Ruby On Rails2 versions
cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*
- (no CPE)range: before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5
ghsa-coords
pkg:gem/actionpack
Range: >= 2.0.0, < 2.3.13

Patches

586a944ddd4d

Tags with invalid names should also be stripped in order to prevent

https://github.com/rails/railsAaron PattersonAug 16, 2011via ghsa

commit

2 files changed · +8 −1

actionpack/lib/action_controller/vendor/html-scanner/html/node.rb+1 −1 modified

@@ -156,7 +156,7 @@ def parse(parent, line, pos, content, strict=true)
           end
 
           closing = ( scanner.scan(/\//) ? :close : nil )
-          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[\w:-]+/)
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/)
           name.downcase!
 
           unless closing

actionpack/test/template/html-scanner/sanitizer_test.rb+7 −0 modified

@@ -5,6 +5,13 @@ def setup
     @sanitizer = nil # used by assert_sanitizer
   end
 
+  def test_strip_tags_with_quote
+    sanitizer = HTML::FullSanitizer.new
+    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'
+
+    assert_equal ' hi', sanitizer.sanitize(string)
+  end
+
   def test_strip_tags
     sanitizer = HTML::FullSanitizer.new
     assert_equal("<<<bad html", sanitizer.sanitize("<<<bad html"))

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1nvdPatchWEB
weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6nvdPatchWEB
www.openwall.com/lists/oss-security/2011/08/17/1nvdPatchWEB
www.openwall.com/lists/oss-security/2011/08/19/11nvdPatchWEB
www.openwall.com/lists/oss-security/2011/08/20/1nvdPatchWEB
www.openwall.com/lists/oss-security/2011/08/22/13nvdPatchWEB
www.openwall.com/lists/oss-security/2011/08/22/5nvdPatchWEB
bugzilla.redhat.com/show_bug.cginvdPatchWEB
github.com/rails/rails/commit/586a944ddd4d03e66dea1093306147594748037anvdPatchWEB
github.com/advisories/GHSA-v5jg-558j-q67cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2011-2931ghsaADVISORY
lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.htmlnvdWEB
lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.htmlnvdWEB
lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.htmlnvdWEB
www.debian.org/security/2011/dsa-2301nvdWEB
www.openwall.com/lists/oss-security/2011/08/22/14nvdWEB
github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2011-2931.ymlghsaWEB
secunia.com/advisories/45921nvd

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000