Rollout::UI is a Minimalist UI for the rollout gem that you can just mount as a Rack app. There is a Cross-site scripting vulnerability in the gem in which the feature's name isn't escaped properly in the "Do you really want to delete" confirmation dialog. When the user clicks "Delete", the page will run the XSS from the feature name. The following PoC triggers a JavaScript alert when clicking at the "Delete" button: http://<host>/features/'+alert(document.cookie)+'