CVE-2020-5267

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

• CWE-80
• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/03/19/1Exploit, Mailing List, Patch, Third Party Advisory
• https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9aPatch, Third Party Advisory
• https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hvExploit, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00019.htmlMailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/03/19/1Exploit, Mailing List, Patch, Third Party Advisory
• https://github.com/rails/rails/commit/033a738817abd6e446e1b320cb7d1a5c15224e9aPatch, Third Party Advisory
• https://github.com/rails/rails/security/advisories/GHSA-65cv-r6x7-79hvExploit, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/03/msg00022.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/

Published

Mar 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5261Saml2 Authentication services for ASP.NET (NuGet package Sus…6.8
• CVE-2020-5262In EasyBuild before version 4.1.2, the GitHub Personal Acces…5.5
• CVE-2020-5263auth0.js (NPM package auth0-js) greater than version 8.0.0 a…4.9
• CVE-2020-5264In PrestaShop before version 1.7.6.5, there is a reflected X…6.1
• CVE-2020-5265In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5266In the ps_link module for PrestaShop before version 3.1.0, t…5.4
• CVE-2020-5268In Saml2 Authentication Services for ASP.NET versions before…7.3
• CVE-2020-5269In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5270In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is…6.1
• CVE-2020-5271In PrestaShop between versions 1.6.0.0 and 1.7.6.5, there is…6.1
• CVE-2020-5272In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is…6.1
• CVE-2020-5273In PrestaShop module ps_linklist versions before 3.1.0, ther…5.4