{"action":"Upgrade stimulus_reflex to 3.4.2 or later.","affected":[{"fixed":"3.5.0.rc4","introduced":"3.5.0.pre0"},{"fixed":"3.4.2","introduced":"0"}],"component":"stimulus_reflex","cve_ids":["CVE-2024-28121"],"ecosystem":"RubyGems","epss":0.01555,"exploited":false,"fixed_versions":["3.5.0.rc4","3.4.2"],"ghsa_id":"GHSA-f78j-4w3g-4q65","id":"tcs_01M5KEJZ3412D8NJ0V3B600MEA","modified_at":"2026-09-10T03:50:10.696117898Z","published_at":"2024-03-12T15:44:49Z","references":["https://osv.dev/vulnerability/GHSA-f78j-4w3g-4q65","https://github.com/stimulusreflex/stimulus_reflex/security/advisories/GHSA-f78j-4w3g-4q65","https://nvd.nist.gov/vuln/detail/CVE-2024-28121","https://github.com/stimulusreflex/stimulus_reflex/commit/538582d240439aab76066c72335ea92096cd0c7f","https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stimulus_reflex/CVE-2024-28121.yml","https://github.com/stimulusreflex/stimulus_reflex","https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83","https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2","https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4","http://seclists.org/fulldisclosure/2024/Mar/16"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-f78j-4w3g-4q65","url":"https://osv.dev/vulnerability/GHSA-f78j-4w3g-4q65"}],"summary":"StimulusReflex arbitrary method call"}