CVE-2020-8264

Name of the Vulnerable Software and Affected Versions: actionpack gem versions 6.0.0 and later

Description: A possible XSS vulnerability exists in the Actionable Exceptions middleware when an application is running in development mode, allowing an attacker to execute JavaScript in the context of the local application by sending or embedding a specially crafted URL.

Recommendations: For actionpack gem versions 6.0.0 and later, disable the Actionable Exceptions middleware in the development environment by adding the line config.middleware.delete ActionDispatch::ActionableExceptions to the config/environment/development.rb file until a patch can be applied.