CVE-2020-8163CWE-94

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call…

published July 2, 2020

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.7th percentile for exploit probability.

CVSS

—

EPSS

82%

Percentile

99.7

In the wild

Unconfirmed

What it is

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.82465 · 99.7th percentile
Weakness: CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published: 2020-07-02T18:35Z

EPSS history

Timeline

02 JUL 18:35Z
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call…
cvelistv5