What is CVE-2021-39197?

CVE-2021-39197 is a medium-severity vulnerability in Bettererrors Better Errors, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.3/10. Published 2021-09-07.

How severe is CVE-2021-39197?

Medium severity. CVSS v3 base score is 6.3 out of 10.

CSRF in Bettererrors Better Errors

CVE-2021-39197

better_errors is an open source replacement for the standard Rails error page with more information rich error pages. It is also usable outside of Rails in any Rack app as Rack middleware. better_errors prior to 2.8.0 did not implement CSRF protection for its internal requests. It also did not enforce the correct "Content-Type" header for these requests, which allowed a cross-origin "simple request" to be made without CORS protection. These together left an application with better_errors enabled open to cross-origin attacks. As a developer tool, better_errors documentation strongly recommends addition only to the `development` bundle group, so this vulnerability should only affect development environments. Please ensure that your project limits better_errors to the `development` group (or the non-Rails equivalent). Starting with release 2.8.x, CSRF protection is enforced. It is recommended that you upgrade to the latest release, or minimally to "~> 2.8.3". There are no known workarounds to mitigate the risk of using older releases of better_errors.

Vulnerability class: CSRF (Cross-Site Request Forgery)

Published 2021-09-07 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

EPSS: 0.006 (49.0th percentile), scored 2026-10-07.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000

Affected products

Bettererrors Better Errors — versions < 2.8.0
Better Errors Project

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

github.com/BetterErrors/better_errors/security/advisories/GHSA-w3j4-76qw-wwjm (Third Party Advisory)
github.com/BetterErrors/better_errors/pull/474 (Patch, Third Party Advisory)
github.com/BetterErrors/better_errors/commit/8e8e796bfbde4aa088741823c8a3fc6df2… (Patch, Third Party Advisory)
github.com/BetterErrors/better_errors/discussions/507 (Third Party Advisory)

Frequently asked questions

What is CVE-2021-39197?: CVE-2021-39197 is a medium-severity vulnerability in Bettererrors Better Errors, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.3/10. Published 2021-09-07.
How severe is CVE-2021-39197?: Medium severity. CVSS v3 base score is 6.3 out of 10.