Threats tagged 'ghsa-68p9-83h6-5wpj'

A cross-site scripting (XSS) vulnerability exists in Action View tag helpers in Ruby on Rails due to improper handling of blank HTML attribute names. Specifically, attribute names that are symbols containing only whitespace bypass blank checks and result in malformed HTML, which can be exploited to inject malicious scripts. This affects applications that allow user-supplied custom HTML attribute names. Fixed versions 8.1.4.1 and 8.0.5.2 address this issue.