CVE-2020-8163
HighPublic exploitRemote code execution via user-provided local names in ActionView
Published Jul 7, 2020 · Updated Sep 9, 2026 · Also known as BIT-rails-2020-8163, DEBIAN-CVE-2020-8163, DLA-2282-1, GHSA-cr3x-7m39-c6jq, SUSE-SU-2020:2140-1, UBUNTU-CVE-2020-8163
Key Facts
Patch immediately- CVE-2020-8163 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Rails (Rubyonrails), Debian Linux, actionview (rubygems) and 5 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including actionview 4.2.11.3, Rails 2:4.2.7.1-1+deb9u3, Rails 2:5.2.0+dfsg-2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2020-8163 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
Affected Products
39 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| RailsRubyonrails | See advisory | 5.0.1 |
| Debian LinuxDebian | 9.0 | n/a |
| actionviewrubygems | See advisory | 4.2.11.3 |
| ruby2.1-rubygem-actionview-4_2suse | See advisory | 4.2.9-9.9.1 |
| ruby2.1-rubygem-activesupport-4_2suse | See advisory | 4.2.9-7.6.1 |
Patched Releases
actionview
4.2.11.3
Rails
2:4.2.7.1-1+deb9u3, 2:5.2.0+dfsg-2, 5.0.1
ruby2.1-rubygem-actionview-4_2
4.2.9-9.9.1
ruby2.1-rubygem-activesupport-4_2
4.2.9-7.6.1
rubygem-actionview-4_2
4.2.9-9.9.1
rubygem-activesupport-4_2
4.2.9-7.6.1
Timeline
Publicly disclosed
Jul 7, 2020
Last updated
Sep 9, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryhttps://bugzilla.suse.com/1173144
- advisoryGHSA advisory
- advisoryhttps://github.com/rails/rails/commit/1f3db0ad793441a0c00e85d56228fc80aafbe6c1
- advisoryhttps://github.com/rails/rails/commit/4c46a15e0a7815ca9e4cd7c7fda042eb8c1b7724
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2020-8163
FAQ
Common Questions.
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
Affected: Rails (Rubyonrails); Debian Linux versions 9.0; actionview (rubygems), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including actionview 4.2.11.3, Rails 2:4.2.7.1-1+deb9u3, Rails 2:5.2.0+dfsg-2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-8163 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo