ActionPack is vulnerable to cross-site scripting (XSS). An attacker is able to embed a specially crafted URL via the location
parameter in Actionable Exceptions middleware while the application server is in development mode, leading to the execution of malicious JavaScript in the context of the local application.