CVE-2023-23913 - CVE House
Back to Database
Status published Unknown CVE-2023-23913

There is a potential DOM based cross-site scripting issue in...

Vulnerability Description

There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23913

Credits & Attribution

No credits recorded in the NVD database.

References

More from Rails

View All →
CVE-2025-24293
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts...
Critical 9.2
CVE-2023-38037
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file....
Medium 5.5
CVE-2023-28362
The redirect_to method in Rails allows provided values to contain...
Unknown 0
CVE-2023-28120
There is a vulnerability in ActiveSupport if the new bytesplice...
Unknown 0
CVE-2023-27539
There is a denial of service vulnerability in the header...
Unknown 0

Affected Vendor

Affected Software

rails-ujs
Vulnerable Versions:
6.1.7.3, 7.0.4.3, 5.1.0

Timeline

Official Publish: January 9th, 2025
Last Modified: January 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.