Description
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
rails rails
>= 7.0.0, < 7.0.8.1affected>= 7.1.0, < 7.1.3.1affected
References
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4 ↗
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc ↗
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e ↗
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947 ↗
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml ↗
- https://security.netapp.com/advisory/ntap-20240510-0004/ ↗