CVE-2015-3226

score

<0.1

cvss

4.3

epss

2.8%

published

2015-07-26

kev added

—

first seen

2026-10-21

Ruby on Rails 3.x and 4.1.x before 4.1.11, 4.2.x before 4.2.2 contain a reflected XSS caused by mishandling of crafted Hash during JSON encoding in json/encoding.rb, letting remote attackers inject arbitrary web script or HTML, exploit requires sending crafted JSON data.