CVE-2024-26143 — Rails Possible XSS Vulnerability in Action Controller
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like …
Published: 2024-02-27 · CVSS: 6.1 · CVSS 3.1
Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7