.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

Vulnerability advisory

CVE-2020-8167

Published Jun 19, 2020Updated Oct 24, 2026OSV record ↗

Also known as GHSA-xq5j-gw7f-jgj8

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
All commits before 7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20	`7b5cc5a5dfcf38522be0a4b5daa97c5b2ba26c20`
66cabeda2c46c582d19738e1318be8d59584cc5b to before 34991a6ae2fc68347c01ea7382fa89004159e019	`34991a6ae2fc68347c01ea7382fa89004159e019`
Also listed as affected (44) `v6.0.3` `v5.2.4.2` `v6.0.3.rc1` `v5.2.4.1` `v5.2.4` `v5.2.4.rc1` `v6.0.0` `v5.2.1.rc1` `v5.2.0.rc1` `v5.1.0.beta1` `v5.0.0.beta4` `v5.0.0.beta2` `v5.0.0.beta1` `v4.2.0.beta1` `v4.0.0.rc1` `v4.0.0.beta1` `v3.2.0.rc1` `v3.1.0.rc1` `v3.1.0.beta1` `v3.0.0.beta3` `v3.0.0.beta.3` `v2.0.1` `v2.0.0` `v2.0.0_RC2` `v2.0.0_RC1` `v2.0.0_PR` `v1.1.1` `v1.1.0` `v1.1.0_RC1` `v0.14.3` `v0.14.1` `v0.13.1` `v0.13.0` `v0.12.0` `v0.11.1` `v0.11.0` `v0.10.1` `v0.10.0` `v0.9.5` `v0.9.4.1` `v0.9.4` `v0.9.3` `v0.9.2` `v0.9.1`

Description

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

References