Vulnerability Spotlight: Ruby Rails Gem XSS Vulnerabilities
Summary: Cisco Talos discovered two XSS vulnerabilities in the filter functionality of the Ruby Rails gems delayed_job_web version 1.4 and rails_admin version 1.2.0, tracked as CVE-2017-12097 and CVE-2017-12098. A specially crafted URL can execute arbitrary JavaScript in a victim's browser to phish users or steal cookies, and Snort rules 44380 and 44381 detect exploitation attempts.
Why it matters: Because gems are reused across many development projects, a single flaw in a package like delayed_job_web or rails_admin can put every system built on it at risk of cookie theft and phishing through a crafted URL.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-12097CVE-2017-12098
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026