CVE-2013-6415: Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/hel...

Security readout for executives and security teams

This vulnerability lets attacker-controlled text be treated as page content when a Rails application uses the number_to_currency helper with an unsafe unit value. The practical business risk is browser-side script execution in affected application pages, which can expose users to session theft, account actions, or misleading content. Exposure is likely limited to Rails applications on vulnerable versions that use number_to_currency with a unit parameter influenced by users, integrations, tenant settings, or stored content. Generic Rails presence alone is not enough evidence of exposure. Treat this as a targeted web application risk, not a broad infrastructure emergency. Prioritize internet-facing Rails apps, customer portals, admin consoles, and multi-tenant systems where users can influence currency display settings or stored content. Mitigation focus: Upgrade Rails to 3.2.16, 4.0.2, or a later supported release.; Apply vendor distribution updates where Rails is supplied by Red Hat, openSUSE, or Debian packages.; Review application code for user-controlled unit values passed to number_to_currency..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.