https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T03:33:28.236616+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2023-28120 CVE-2023-28120 2026-09-29T03:33:28.239126+00:00

Affected: Rails ActiveSupport

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

 https://vulnerability.circl.lu/vuln/ghsa-pj73-v5mw-pm9j GHSA-pj73-v5mw-pm9j — Possible XSS Security Vulnerability in SafeBuffer#bytesplice 2026-09-29T03:33:28.239220+00:00

Affected: RubyGems: activesupport

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.