{"action":"Upgrade phlex to 1.11.1 or later.","affected":[{"fixed":"2.4.1","introduced":"2.4.0.beta1"},{"fixed":"2.3.2","introduced":"2.3.0"},{"fixed":"2.2.2","introduced":"2.2.0"},{"fixed":"2.1.3","introduced":"2.1.0"},{"fixed":"2.0.2","introduced":"2.0.0.beta1"},{"fixed":"1.11.1","introduced":"0"}],"component":"phlex","cve_ids":[],"ecosystem":"RubyGems","exploited":false,"fixed_versions":["2.4.1","2.3.2","2.2.2","2.1.3","2.0.2","1.11.1"],"ghsa_id":"GHSA-w67g-2h6v-vjgq","id":"tcs_01M5KENTBCWE1DFKXBKPDV0HEW","modified_at":"2026-02-06T20:58:00.573179Z","published_at":"2026-02-06T19:35:09Z","references":["https://osv.dev/vulnerability/GHSA-w67g-2h6v-vjgq","https://github.com/yippee-fun/phlex/security/advisories/GHSA-w67g-2h6v-vjgq","https://github.com/yippee-fun/phlex/commit/1d85da417cb15eb8cb2f54a68d531c9b35d9d03a","https://github.com/yippee-fun/phlex/commit/556441d5a64ff93f749e8116a05b2d97264468ee","https://github.com/yippee-fun/phlex/commit/74e3d8610ffabc2cf5f241945e9df4b14dceb97d","https://github.com/yippee-fun/phlex/commit/9f56ad13bea9a7d6117fdfd510446c890709eeac","https://github.com/yippee-fun/phlex/commit/fe9ea708672f9fa42526d9b47e1cdc4634860ef1","https://github.com/yippee-fun/phlex"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-w67g-2h6v-vjgq","url":"https://osv.dev/vulnerability/GHSA-w67g-2h6v-vjgq"}],"summary":"Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values"}