CVE-2019-10770: HTML Content Injection (XSS) in Ratpack
Summary
CVE-2019-10770: Default development error handler in Ratpack is vulnerable to HTML content injection (XSS). Affects io.ratpack:ratpack-core versions < 1.7.6. Fixed in 1.7.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ratpack is an open-source web framework for building reactive applications in Java or Kotlin. It provides a simple and lightweight API for creating scalable and high-performance web applications. The affected package, io.ratpack:ratpack-core, is a core component of Ratpack that handles request handling and error handling.
Vulnerability Detail
The default development error handler in Ratpack is vulnerable to HTML content injection (XSS). This vulnerability, identified as CWE-79, occurs when untrusted data is not properly neutralized during web page generation. In versions 0.9.10 through 1.7.5, an attacker can exploit this vulnerability to perform XSS attacks by injecting malicious HTML content into exception messages. For example, if a user-supplied query parameter is appended to an exception message without proper sanitization, an attacker can inject malicious scripts that will be executed when the exception is displayed.
How To Fix
Latest published version: 2.0.0-rc-1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version of Ratpack is not feasible, there are a few workarounds and mitigations that can be implemented. Firstly, ensure that development mode is disabled in production environments. This can be done by setting the 'development' flag to 'false' in the Ratpack server configuration. Additionally, avoid using real customer data or untrusted user input in development environments to minimize the risk of XSS attacks.
Conclusion
The default development error handler in Ratpack is vulnerable to HTML content injection (XSS). It is crucial to update to the latest version of Ratpack (1.7.6 or later) to mitigate this vulnerability. If updating is not possible, disable development mode in production and avoid using untrusted user input or real customer data in development. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for io.ratpack:ratpack-core →
FAQ
Ratpack is an open-source web framework for building reactive applications in Java or Kotlin. It provides a lightweight and scalable API for developing high-performance web applications.
HTML content injection, also known as cross-site scripting (XSS), is a vulnerability that allows attackers to inject malicious HTML or scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
The vulnerability in Ratpack occurs when untrusted data is not properly sanitized or neutralized during the generation of web pages. In this case, the development error handler in Ratpack allows for the injection of untrusted data into exception messages, which can be exploited by attackers to perform XSS attacks.
The impact of this vulnerability is cross-site scripting (XSS), which allows attackers to execute malicious scripts within the context of a user's browser. This can lead to various consequences, such as stealing sensitive information, performing actions on behalf of the user, or defacing the affected web application.
To mitigate this vulnerability, it is recommended to update to the latest version of Ratpack (1.7.6 or later) that includes a patch for the XSS vulnerability. Additionally, disable development mode in production environments and avoid using untrusted user input or real customer data in development environments.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.ratpack:ratpack-core.
