RubyGems/phlex: high 7.1
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values
Action: Upgrade phlex to 1.11.1 or later.
bundle update phlexAffected
| introduced | fixed | last affected |
|---|---|---|
| 2.4.0.beta1 | 2.4.1 | - |
| 2.3.0 | 2.3.2 | - |
| 2.2.0 | 2.2.2 | - |
| 2.1.0 | 2.1.3 | - |
| 2.0.0.beta1 | 2.0.2 | - |
| 0 | 1.11.1 | - |
Fixed versions
| 2.4.1 | 2.3.2 | 2.2.2 | 2.1.3 | 2.0.2 | 1.11.1 |
Sources
- osv: GHSA-w67g-2h6v-vjgq
- https://github.com/yippee-fun/phlex/security/advisories/GHSA-w67g-2h6v-vjgq
- https://github.com/yippee-fun/phlex/commit/1d85da417cb15eb8cb2f54a68d531c9b35d9d03a
- https://github.com/yippee-fun/phlex/commit/556441d5a64ff93f749e8116a05b2d97264468ee
- https://github.com/yippee-fun/phlex/commit/74e3d8610ffabc2cf5f241945e9df4b14dceb97d
- https://github.com/yippee-fun/phlex/commit/9f56ad13bea9a7d6117fdfd510446c890709eeac
- https://github.com/yippee-fun/phlex/commit/fe9ea708672f9fa42526d9b47e1cdc4634860ef1
- https://github.com/yippee-fun/phlex
published · modified · JSON