Reflected XSS in the resque-web stats/keys endpoint
Published: September 09, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-m39q-9jm7-xp4q
- Vendor Advisory: https://github.com/resque/resque/security/advisories/GHSA-m39q-9jm7-xp4q
GEM
SEVERITY
CVSS v3.x: 6.3 (Medium)
PATCHED VERSIONS
>= 3.0.1
DESCRIPTION
Impact
The following paths in resque-web have been found to be vulnerable to reflected XSS:
/stats/keys/<img src=x onerror=alert(document.domain)>
Patches
v3.0.1
Workarounds
No known workarounds at this time. It is recommended to not click on 3rd party or untrusted links to the resque-web interface until you have patched your application.
References
https://github.com/resque/resque/pull/1942