DemoBook a demo

Vulnerability advisory

CVE-2019-5418

Published Updated OSV record ↗

Also known as GHSA-86g5-2wh3-gc9j

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/rails/rails ↗
9891ca89c69732a21743f0349f2995956a7802e7 to before e06a1e09b6bec32b0a05c72a3ae7ceb00f61bf7de06a1e09b6bec32b0a05c72a3ae7ceb00f61bf7d
2efddadd6cba4e2129acedf1d402d11abcc03996 to before c4d3e202e10ae627b3b9c34498afb45450652421c4d3e202e10ae627b3b9c34498afb45450652421
ce93740a5e4437dfc1cf9b0b13da1bad06a2a598 to before ec8697bf0bfafff7d897fb50e322afe42ddc1623ec8697bf0bfafff7d897fb50e322afe42ddc1623
375a4143cf5caeb6159b338be824903edfd62836 to before e69ff43060c1194d2a3bd9b8d9e23f3ae26b84b5e69ff43060c1194d2a3bd9b8d9e23f3ae26b84b5
Also listed as affected (7)
  • v5.1.6.1
  • v5.1.6
  • v5.1.4.rc1
  • v5.1.3.rc1
  • v5.1.2.rc1
  • v5.1.1
  • v5.1.0

Description

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.