CVE-2011-0446: Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, a...

Security readout for executives and security teams

This vulnerability affects old Ruby on Rails applications that use the mail_to helper with JavaScript encoding. A crafted display name or email value could cause malicious script or HTML to run in a user's browser. The risk depends on whether the vulnerable helper is used with attacker-controlled input. Exposure is most likely in legacy Rails 2.3.x or 3.0.x applications that render mail_to links with JavaScript encoding and dynamic name or email values. Modern Rails versions should not be assumed affected from these sources. Prioritize if the organization still runs legacy Rails applications, especially externally facing portals. This is not KEV-listed in the supplied data, but XSS can affect users and sessions when reachable through user-controlled content. Mitigation focus: Upgrade Rails to 2.3.11, 3.0.4, or a later supported release.; Apply relevant vendor or distribution security updates where Rails is packaged.; Review Rails security guidance before relying on local workarounds..

Prepared

Jun 27, 2026, 18:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.