CVE-2020-15169

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

• CWE-79

• https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory
• https://github.com/rails/rails/security/advisories/GHSA-cfjv-5498-mph5Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/10/msg00015.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory

Published

Sep 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15163Python TUF (The Update Framework) reference implementation b…8.2
• CVE-2020-15164in Scratch Login (MediaWiki extension) before version 1.1, a…10
• CVE-2020-15165Version 1.1.6-free of Chameleon Mini Live Debugger on Google…9.1
• CVE-2020-15166In ZeroMQ before version 4.3.3, there is a denial-of-service…7.5
• CVE-2020-15167In Miller (command line utility) using the configuration fil…8.6
• CVE-2020-15168node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not ho…5.3
• CVE-2020-1517An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-15170apollo-adminservice before version 1.7.1 does not implement …7
• CVE-2020-15171In XWiki before versions 11.10.5 or 12.2.1, any user with SC…6.6
• CVE-2020-15172The Act module for Red Discord Bot before commit 6b9f3b86 is…8.8
• CVE-2020-15173In ACCEL-PPP (an implementation of PPTP/PPPoE/L2TP/SSTP), th…9.8
• CVE-2020-15174In Electron before versions 11.0.0-beta.1, 10.0.1, 9.3.0 or …7.5