CVE-2016-6316

score

<0.1

cvss

6.1

epss

3.4%

published

2016-09-07

kev added

—

first seen

2026-10-21

Ruby on Rails 3.x < 3.2.22.3, 4.x < 4.2.7.1, and 5.x < 5.0.0.1 contain a reflected cross-site scripting caused by improper handling of 'HTML safe' text used as attribute values in Action View, letting remote attackers inject arbitrary web script or HTML, exploit requires attacker to craft malicious input.