{"id":"CVE-2024-32463","aliases":["GHSA-g7xq-xv8c-h98c"],"url":"https://o3.security/vulnerability/CVE-2024-32463","summary":"phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags","details":"### Summary\nThere is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.\n\nOur filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`.\n\n### Impact\n\nIf you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.\n\n```ruby\na(href: user_profile) { \"Profile\" }\n```\n\n### Mitigation\n\nThe best way to mitigate this vulnerability is to update to one of the following versions:\n\n- [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)\n- [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)\n- [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)\n- [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)\n- [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)\n- [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)\n- [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)\n\n### Workarounds\nConfiguring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.","published":"2024-04-17T15:29:14.463Z","modified":"2026-08-12T03:51:18.210373663Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.10.1"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.9.2"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.8.3"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.7.2"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.6.3"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.5.3"},{"ecosystem":"RubyGems","name":"phlex","fixedVersion":"1.4.2"}],"fix":{"url":"https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb","label":"phlex-ruby/phlex@9e3f5b9"},"references":[{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"},{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32463.json"},{"type":"ADVISORY","url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32463"},{"type":"FIX","url":"https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"},{"type":"PACKAGE","url":"https://github.com/phlex-ruby/phlex"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:18.210373663Z"}}