# I Found XSS Security Flaws in Rails – Here's What Happened.

Rails escape_javascript failed to escape backticks and ${}, letting untrusted data in template literals execute JS for XSS.

- Payout: $500
- Severity: medium
- Program: Ruby on Rails
- Credited: Jesse Campos
- Disclosed: 2020-05-07
- Write-up quality: 7/10
- Original: https://chefsecure.com/blog/i-found-xss-security-flaws-in-rails-heres-what-happened
- Library page: https://bugbountylibrary.com/r/blog%3Achefsecure-com-blog-i-found-xss-security-flaws-in-rails-heres-what-happened
- Tags: domain:web impact:ato kind:bounty platform:blog sev:medium tech:ruby technique:incomplete-fix technique:source-review vuln:xss

**Target:** escape_javascript helper / ERB views using template literals
**Root cause:** escape_javascript's JS_ESCAPE_MAP only escaped single/double quotes and backslashes, not backticks or the $ character, so ES6 template literals could be broken out of or interpolated.
**Steps:**
1. Render untrusted data inside a template literal: `<%= j user.name %> is #{getStatus(<%= user.id %>)}`
2. Inject backtick breakout payload `+alert()+` into the escaped value
3. After backtick fix, inject interpolation payload `${alert()}` without breaking out
4. Fix requires escaping ` and $ in JS_ESCAPE_MAP and the gsub regex
**How found:** Code review of the escape_javascript escape map against ES6 template literal syntax; noticed backtick and ${} were absent from the escaped character set, then crafted breakout and interpolation payloads.
**Exploitation:** Attacker-controlled input reflected into a JS template literal executes arbitrary JavaScript in the victim's browser, enabling account hijack and data theft.
**Insight:** When auditing JS-string escapers, enumerate every string-delimiter and interpolation token of the target language (backticks, ${}, and future syntax), not just legacy quote characters.