CVE-2013-4491: Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the...

Security readout for executives and security teams

This is a reflected cross-site scripting flaw in older Ruby on Rails releases. A remote attacker could cause a vulnerable application to output attacker-controlled script or HTML through Rails internationalization fallback behavior. Business risk is highest for legacy public Rails applications that still run affected versions. Exposure is most likely in internet-facing Rails applications running Rails 3.x before 3.2.16 or 4.x before 4.0.2, especially where translation helpers process attacker-influenced input. Modern Rails versions should not be assumed affected from these sources. Address during legacy application remediation, with faster handling for public Rails apps. The issue can support browser-side compromise, but current sources do not show active exploitation or critical scoring. Mitigation focus: Upgrade Rails 3.x applications to at least 3.2.16.; Upgrade Rails 4.x applications to at least 4.0.2.; Use fixed operating-system or vendor packages where Rails is distro-managed..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.