Vulnerability advisory

GHSA-4whc-pp4x-9pf3

jquery-rails and jquery-ujs subject to Exposure of Sensitive Information

Published Oct 24, 2017Updated Feb 3, 2026OSV record ↗

Also known as CVE-2015-1840

Severity

Severity not reported.

Affected versions

jquery-rails RubyGems

All jquery-rails advisories →

Affected	Fixed in
All versions before 3.1.3	`3.1.3`Advisories →
Also listed as affected (52) `0.1.1` `0.1.2` `0.1.3` `0.2` `0.2.1` `0.2.2` `0.2.3` `0.2.4` `0.2.5` `0.2.6` `0.2.7` `1.0` `1.0.1` `1.0.10` `1.0.11` `1.0.12` `1.0.13` `1.0.14` `1.0.15` `1.0.16` `1.0.17` `1.0.18` `1.0.19` `1.0.2` `1.0.3` `1.0.4` `1.0.5` `1.0.6` `1.0.7` `1.0.8` `1.0.9` `1.0.rc` `2.0.1` `2.0.2` `2.0.3` `2.1.0` `2.1.1` `2.1.2` `2.1.3` `2.1.4` `2.2.0` `2.2.1` `2.2.2` `2.3.0` `3.0.0` `3.0.1` `3.0.2` `3.0.3` `3.0.4` `3.1.0` `3.1.1` `3.1.2`
`4.0.0` to before 4.0.4	`4.0.4`Advisories →
Also listed as affected (4) `4.0.0` `4.0.1` `4.0.2` `4.0.3`

jquery-ujs RubyGems

All jquery-ujs advisories →

Affected	Fixed in
All versions before 1.0.4	`1.0.4`Advisories →

Description

jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value.

GHSA-4whc-pp4x-9pf3

Affected versions

jquery-rails RubyGems

jquery-ujs RubyGems

Description

References