Description
Ruby on Rails web applications that pass unverified user input to the render method in a controller or a view may be vulnerable to a code injection.
Remediation
All users running an affected release should either upgrade or use one of the workarounds immediately. A workaround to this issue is to not pass arbitrary user input to the render method. Instead, verify that data before passing it to the render method. Consult Web references for more information about this issue.