Overview
CVE-2007-3227 describes an XSS vulnerability in Ruby on Rails via ActiveRecord::Base#to_json before edge 9606. The vulnerability (CWE-79) allowed remote attackers to inject arbitrary web script via input values when JSON was embedded in an HTML response. This occurred because JSON produced by to_json could be placed into HTML/JavaScript contexts without sufficiently escaping potentially dangerous input.
In practice, a malicious user could supply crafted input that, when serialized by to_json and inserted into a page (for example inside a script tag or a data attribute), could be executed by the browser, leading to session hijacking, credential theft, or defacement.
Remediation emphasizes upgrading Rails to a fixed release (edge 9606 or later) and adopting safe rendering practices. Do not render raw JSON into HTML or JavaScript contexts; instead, escape JSON for JavaScript with json_escape or Rails' j helper, and validate/sanitize user input. This approach mitigates the specific risk described in CVE-2007-3227 and reduces exposure to similar XSS vectors in Rails apps.
Affected Versions
Rails before edge 9606
Code Fix Example
Ruby on Rails API Security Remediation
Vulnerable:
<script>
var payload = <%= @payload.to_json %>;
</script>
Fixed:
<script>
var payload = <%= j @payload.to_json %>;
</script>