{"id":"CVE-2024-37031","aliases":["GHSA-9mg6-x45v-hcfm"],"url":"https://o3.security/vulnerability/CVE-2024-37031","summary":"activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends","details":"### Impact\n\nUsers settings their active admin form legends dynamically may be vulnerable to stored XSS, as long as its value can be injected directly by a malicious user.\n\nFor example:\n\n* A public web application allows users to create entities with arbitrary names.\n* Active Admin is used to administrate these entities through a private backend.\n* The form to edit these entities in the private backend has the following shape (note the dynamic `name` value dependent on an attribute of the `resource`):\n\n```ruby\n  form do |f|\n    f.inputs name: resource.name do\n      f.input :name\n      f.input :description\n    end\n\n    f.actions\n  end\n```\n\nThen a malicious user could create an entity with a payload that would get executed in the active admin administrator's browser.\n\nBoth `form` blocks with an implicit or explicit name (i.e., both `form resource.name` or `form name: resource.name` would suffer from the problem), where the value of the name can be arbitrarily set by non admin users.\n\n### Patches\n\nThe problem has been fixed in ActiveAdmin 3.2.2 and ActiveAdmin 4.0.0.beta7.\n\n### Workarounds\n\nUsers can workaround this problem without upgrading by explicitly escaping the form name using an HTML escaping utility. For example:\n\n```ruby\n  form do |f|\n    f.inputs name: ERB::Util.html_escape(resource.name) do\n      f.input :name\n      f.input :description\n    end\n\n    f.actions\n  end\n```\nUpgrading is of course recommended though.\n\n### References\nhttps://owasp.org/www-community/attacks/xss/#stored-xss-attacks","published":"2024-06-03T05:54:46.881Z","modified":"2026-08-12T03:51:44.915991618Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.00349,"percentile":0.28096,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"activeadmin","fixedVersion":"3.2.2"},{"ecosystem":"RubyGems","name":"activeadmin","fixedVersion":"4.0.0.beta7"}],"fix":{"url":"https://github.com/activeadmin/activeadmin/pull/8349","label":"activeadmin/activeadmin#8349"},"references":[{"type":"WEB","url":"https://github.com/activeadmin/activeadmin/releases/tag/v3.2.2"},{"type":"WEB","url":"https://rubygems.org/gems/activeadmin/versions/3.2.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37031.json"},{"type":"ADVISORY","url":"https://github.com/activeadmin/activeadmin/security/advisories/GHSA-9mg6-x45v-hcfm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37031"},{"type":"WEB","url":"https://github.com/activeadmin/activeadmin/pull/8349"},{"type":"PACKAGE","url":"https://github.com/activeadmin/activeadmin"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activeadmin/CVE-2024-37031.yml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:44.915991618Z"}}