CVE-2007-3227: Cross-site scripting (XSS) vulnerability in the to_json (ActiveRecord::Base#to_json) function in Ruby on Ra...

Security readout for executives and security teams

CVE-2007-3227 is an old Ruby on Rails cross-site scripting issue in JSON output generation. Affected Rails code could turn user-controlled input into script that runs in another user’s browser. Business impact depends on whether legacy Rails applications still run the vulnerable code path. Exposure is most likely in legacy Ruby on Rails applications or distro-packaged Rails deployments from the 2007 era that use ActiveRecord::Base#to_json with untrusted input. Treat this as a legacy-exposure cleanup item unless an internet-facing Rails application still runs affected code. Prioritize remediation for customer-facing apps, authenticated portals, or admin interfaces where session theft or account actions would matter. Mitigation focus: Inventory Ruby on Rails applications and packaged Rails versions still in service.; Upgrade Rails using official Rails, Gentoo, or SUSE guidance for this CVE.; Confirm the deployed version includes the edge 9606 or later fix where applicable..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.