CVE-2013-6416

score

<0.1

cvss

4.3

epss

2.0%

published

2013-12-07

kev added

—

first seen

2026-10-21

Ruby on Rails 4.x before 4.0.2 contains a reflected XSS caused by insufficient sanitization in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb, letting remote attackers inject arbitrary web script or HTML via a crafted HTML attribute, exploit requires sending malicious input to the application.