CVE-2024-26143

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/blob/cc431b3424123d84bcd7afd4de150b33f117a8ef/cves/2024/26xxx/CVE-2024-26143.json",
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Git / github.com/rails/rails

Affected ranges

Type

GIT

Repo

https://github.com/rails/rails

Events

Introduced

984c3ef2775781d47efa9f541ce570daa2434a80

Fixed

506462ab13755d9f024e1ddbfc8c58d73e7a1bce

Database specific

{
    "versions": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.0.8.1"
        }
    ]
}

Type

GIT

Repo

https://github.com/rails/rails

Events

Introduced

d39db5d1891f7509cde2efc425c9d69bbb77e670

Fixed

d73ed958dc91d6b8cbb0bef7b4cdcfc013bd876f

Database specific

{
    "versions": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.3.1"
        }
    ]
}