CVE-2020-8163
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to...
- Published
- Jul 2, 2020
- Updated
- Aug 4, 2024
- Assigning CNA
- hackerone
- Evidence observed
- Jul 26, 2020
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.7%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Sources
http/cves/2020/CVE-2020-8163.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: regex,status($.matchers[*].type)
- CVE-2020-8163Exploit
Docker-based lab environment and exploit script for CVE-2020-8163, a blind remote code execution vulnerability in Rails versions before 5.0.1 and 4.2.11.2.
- CVE-2020-8163Exploit
CVE-2020-8163 - Remote code execution of user-provided local names in Rails
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.