A rails security update has been released for Debian GNU/Linux 8 LTS to address a possible XSS vulnerability in ActionView's JavaScript literal escape helpers.

Package : rails
Version : 2:4.1.8-1+deb8u6
CVE ID : CVE-2020-5267
Debian Bug : 954304

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a
possible XSS vulnerability in ActionView's JavaScript literal
escape helpers.
Views that use the `j` or `escape_javascript` methods may be
susceptible to XSS attacks.

For Debian 8 "Jessie", this problem has been fixed in version
2:4.1.8-1+deb8u6.

We recommend that you upgrade your rails packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS