Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-qw3q-6gwf-vufy
Vulnerability ID VCID-qw3q-6gwf-vufy
Aliases CVE-2024-32970
GHSA-9p57-h987-4vgx
Summary Phlex vulnerable to Cross-site Scripting (XSS) via maliciously formed HTML attribute names and values There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The reason these issues were not detected before is the escapes were working as designed. However, their design didn't take into account just how recklessly permissive browser are when it comes to executing unsafe JavaScript via HTML attributes. ### Impact If you render an `<a>` tag with an `href` attribute set to an user-provided link, that link could potentially execute JavaScript when clicked by another user. ```ruby a(href: user_profile) { "Profile" } ``` If you splat user-provided attributes when rendering any HTML or SVG tag, malicious event attributes could be included in the output, executing JavaScript when the events are triggered by another user. ```ruby h1(**JSON.parse(user_attributes)) ``` ### Patches Patches are [available on RubyGems](https://rubygems.org/gems/phlex) for all minor versions released in the last year. - [1.10.2](https://rubygems.org/gems/phlex/versions/1.10.2) - [1.9.3](https://rubygems.org/gems/phlex/versions/1.9.3) If you are on `main`, it has been patched since [`da8f943`](https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2) ### Workarounds Configuring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited. ### References In addition to upgrading to a patched version of Phlex, we strongly recommend configuring a Content Security Policy header that does not allow `unsafe-inline`. Here’s how you can configure a Content Security Policy header in Rails. https://guides.rubyonrails.org/security.html#content-security-policy-header
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00283 https://api.first.org/data/v1/epss?cve=CVE-2024-32970
cvssv3.1 7.1 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
generic_textual HIGH https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
ssvc Track https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
cvssv3.1 7.1 https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
generic_textual HIGH https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
ssvc Track https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-9p57-h987-4vgx
cvssv3.1 7.1 https://github.com/payloadbox/xss-payload-list
generic_textual HIGH https://github.com/payloadbox/xss-payload-list
ssvc Track https://github.com/payloadbox/xss-payload-list
cvssv3.1 7.1 https://github.com/phlex-ruby/phlex
generic_textual HIGH https://github.com/phlex-ruby/phlex
cvssv3.1 7.1 https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
generic_textual HIGH https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
ssvc Track https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
cvssv3 7.1 https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
cvssv3.1 7.1 https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
cvssv3.1_qr HIGH https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
generic_textual HIGH https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
ssvc Track https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
cvssv3.1 7.1 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml
generic_textual HIGH https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2024-32970
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-32970
cvssv3.1 7.1 https://rubygems.org/gems/phlex
generic_textual HIGH https://rubygems.org/gems/phlex
ssvc Track https://rubygems.org/gems/phlex
cvssv3.1 7.1 https://rubygems.org/gems/phlex/versions/1.10.2
generic_textual HIGH https://rubygems.org/gems/phlex/versions/1.10.2
cvssv3.1 7.1 https://rubygems.org/gems/phlex/versions/1.9.3
generic_textual HIGH https://rubygems.org/gems/phlex/versions/1.9.3
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-32970
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
https://github.com/payloadbox/xss-payload-list
https://github.com/phlex-ruby/phlex
https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml
https://rubygems.org/gems/phlex
https://rubygems.org/gems/phlex/versions/1.10.2
https://rubygems.org/gems/phlex/versions/1.9.3
CVE-2024-32970 https://nvd.nist.gov/vuln/detail/CVE-2024-32970
GHSA-9p57-h987-4vgx https://github.com/advisories/GHSA-9p57-h987-4vgx
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/payloadbox/xss-payload-list
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://github.com/payloadbox/xss-payload-list
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/phlex-ruby/phlex
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://github.com/phlex-ruby/phlex/commit/da8f94342a84cff9d78c98bcc3b3604ee2e577d2
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://github.com/phlex-ruby/phlex/security/advisories/GHSA-9p57-h987-4vgx
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-32970
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://rubygems.org/gems/phlex
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-06-18T15:29:00Z/ Found at https://rubygems.org/gems/phlex
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://rubygems.org/gems/phlex/versions/1.10.2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N Found at https://rubygems.org/gems/phlex/versions/1.9.3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.52005
EPSS Score 0.00283
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:14:46.102402+00:00 Ruby Importer Import https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32970.yml 38.6.0