Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/phlex@1.7.1
purl pkg:gem/phlex@1.7.1
Next non-vulnerable version 1.11.1
Latest non-vulnerable version 2.4.1
Risk 4.0
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-fr4p-b13u-nbhf
Aliases:
GHSA-w67g-2h6v-vjgq
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex. 1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. `div(**user_attributes)`. 2. The second bypass could happen if user-provided tag names were passed to the `tag` method, e.g. `tag(some_tag_name_from_user)`. 3. The third bypass could happen if user’s links were passed to `href` attributes, e.g. `a(href: user_provided_link)`. All three of these patterns are meant to be safe and all have now been patched.
1.11.1
Affected by 0 other vulnerabilities.
2.0.2
Affected by 1 other vulnerability.
2.1.3
Affected by 0 other vulnerabilities.
2.2.2
Affected by 0 other vulnerabilities.
2.3.2
Affected by 0 other vulnerabilities.
2.4.0.beta1
Affected by 1 other vulnerability.
2.4.1
Affected by 0 other vulnerabilities.
VCID-m3kh-42bg-ykd8
Aliases:
CVE-2024-32463
GHSA-g7xq-xv8c-h98c
Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`.
1.7.2
Affected by 2 other vulnerabilities.
1.8.3
Affected by 2 other vulnerabilities.
1.9.2
Affected by 2 other vulnerabilities.
1.10.1
Affected by 2 other vulnerabilities.
VCID-qw3q-6gwf-vufy
Aliases:
CVE-2024-32970
GHSA-9p57-h987-4vgx
Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The reason these issues were not detected before is the escapes were working as designed. However, their design didn't take into account just how recklessly permissive browser are when it comes to executing unsafe JavaScript via HTML attributes. ### Impact If you render an `<a>` tag with an `href` attribute set to an user-provided link, that link could potentially execute JavaScript when clicked by another user. ```ruby a(href: user_profile) { "Profile" } ``` If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. ```ruby h1(**JSON.parse(user_attributes)) ``` ### Patches Patches are [available on RubyGems](https://rubygems.org/gems/phlex) for all minor versions released in the last year. - [1.10.2](https://rubygems.org/gems/phlex/versions/1.10.2) - [1.9.3](https://rubygems.org/gems/phlex/versions/1.9.3) If you are on `main`, it has been patched since [`da8f943`](https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2) ### Workarounds Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited. ### References In addition to upgrading to a patched version of Phlex, we strongly recommend configuring a Content Security Policy header that does not allow `unsafe-inline`. Here’s how you can configure a Content Security Policy header in Rails. https://guides.rubyonrails.org/security.html#content-security-policy-header
1.9.3
Affected by 1 other vulnerability.
1.10.2
Affected by 1 other vulnerability.
VCID-uaqs-9f9c-6yex
Aliases:
CVE-2024-28199
GHSA-242p-4v39-2v8g
Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. ### Impact If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. ```ruby a(href: user_profile) { "Profile" } ``` If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. ```ruby h1(**JSON.parse(user_attributes)) ``` ### Patches Patches are [available on RubyGems](https://rubygems.org/gems/phlex) for all `1.x` minor versions. The patched versions are: - [1.9.1](https://rubygems.org/gems/phlex/versions/1.9.1) - [1.8.2](https://rubygems.org/gems/phlex/versions/1.8.2) - [1.7.1](https://rubygems.org/gems/phlex/versions/1.7.1) - [1.6.2](https://rubygems.org/gems/phlex/versions/1.6.2) - [1.5.2](https://rubygems.org/gems/phlex/versions/1.5.2) - [1.4.1](https://rubygems.org/gems/phlex/versions/1.4.1) - [1.3.3](https://rubygems.org/gems/phlex/versions/1.3.3) - [1.2.2](https://rubygems.org/gems/phlex/versions/1.2.2) - [1.1.1](https://rubygems.org/gems/phlex/versions/1.1.1) - [1.0.1](https://rubygems.org/gems/phlex/versions/1.0.1) If you are on `main`, it has been patched since [`aa50c60`](https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1) ### Workarounds Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited. ### References In addition to upgrading to a patched version of Phlex, we strongly recommend configuring a Content Security Policy header that does not allow `unsafe-inline`. Here’s how you can configure a Content Security Policy header in Rails. https://guides.rubyonrails.org/security.html#content-security-policy-header
1.8.2
Affected by 4 other vulnerabilities.
1.9.1
Affected by 4 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-uaqs-9f9c-6yex Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. This was due to improper case-sensitivity in the code that was meant to prevent these attacks. ### Impact If you render an `<a>` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user. ```ruby a(href: user_profile) { "Profile" } ``` If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. ```ruby h1(**JSON.parse(user_attributes)) ``` ### Patches Patches are [available on RubyGems](https://rubygems.org/gems/phlex) for all `1.x` minor versions. The patched versions are: - [1.9.1](https://rubygems.org/gems/phlex/versions/1.9.1) - [1.8.2](https://rubygems.org/gems/phlex/versions/1.8.2) - [1.7.1](https://rubygems.org/gems/phlex/versions/1.7.1) - [1.6.2](https://rubygems.org/gems/phlex/versions/1.6.2) - [1.5.2](https://rubygems.org/gems/phlex/versions/1.5.2) - [1.4.1](https://rubygems.org/gems/phlex/versions/1.4.1) - [1.3.3](https://rubygems.org/gems/phlex/versions/1.3.3) - [1.2.2](https://rubygems.org/gems/phlex/versions/1.2.2) - [1.1.1](https://rubygems.org/gems/phlex/versions/1.1.1) - [1.0.1](https://rubygems.org/gems/phlex/versions/1.0.1) If you are on `main`, it has been patched since [`aa50c60`](https://github.com/phlex-ruby/phlex/commit/aa50c604cdee1d0ce7ef068a4c66cbd5d43f96a1) ### Workarounds Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited. ### References In addition to upgrading to a patched version of Phlex, we strongly recommend configuring a Content Security Policy header that does not allow `unsafe-inline`. Here’s how you can configure a Content Security Policy header in Rails. https://guides.rubyonrails.org/security.html#content-security-policy-header CVE-2024-28199
GHSA-242p-4v39-2v8g

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T06:50:58.514280+00:00 GitLab Importer Affected by VCID-fr4p-b13u-nbhf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/phlex/GHSA-w67g-2h6v-vjgq.yml 38.6.0
2026-06-06T04:50:52.261602+00:00 GitLab Importer Affected by VCID-qw3q-6gwf-vufy https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/phlex/CVE-2024-32970.yml 38.6.0
2026-06-06T04:49:47.288071+00:00 GitLab Importer Affected by VCID-m3kh-42bg-ykd8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/phlex/CVE-2024-32463.yml 38.6.0
2026-06-05T21:40:59.975699+00:00 GHSA Importer Fixing VCID-uaqs-9f9c-6yex https://github.com/advisories/GHSA-242p-4v39-2v8g 38.6.0
2026-06-04T18:15:59.941301+00:00 Ruby Importer Affected by VCID-fr4p-b13u-nbhf https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/GHSA-w67g-2h6v-vjgq.yml 38.6.0
2026-06-04T18:14:55.303255+00:00 Ruby Importer Affected by VCID-m3kh-42bg-ykd8 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml 38.6.0
2026-06-04T18:14:53.534035+00:00 Ruby Importer Fixing VCID-uaqs-9f9c-6yex https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-28199.yml 38.6.0
2026-06-04T18:14:53.101663+00:00 Ruby Importer Affected by VCID-uaqs-9f9c-6yex https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-28199.yml 38.6.0
2026-06-04T16:49:37.563271+00:00 GithubOSV Importer Fixing VCID-uaqs-9f9c-6yex https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/03/GHSA-242p-4v39-2v8g/GHSA-242p-4v39-2v8g.json 38.6.0
2026-06-02T04:47:20.505761+00:00 GitLab Importer Fixing VCID-uaqs-9f9c-6yex https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/phlex/CVE-2024-28199.yml 38.6.0