{"id":"GHSA-g7xq-xv8c-h98c","summary":"Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `\u003ca\u003e` tags","details":"### Summary\nThere is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data.\n\nOur filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `\u003ca\u003e` tag could be bypassed with tab `\\t` or newline `\\n` characters between the characters of the protocol, e.g. `java\\tscript:`.\n\n### Impact\n\nIf you render an `\u003ca\u003e` tag with an `href` attribute set to a user-provided link, that link could potentially execute JavaScript when clicked by another user.\n\n```ruby\na(href: user_profile) { \"Profile\" }\n```\n\n### Mitigation\n\nThe best way to mitigate this vulnerability is to update to one of the following versions:\n\n- [1.10.1](https://rubygems.org/gems/phlex/versions/1.10.1)\n- [1.9.2](https://rubygems.org/gems/phlex/versions/1.9.2)\n- [1.8.3](https://rubygems.org/gems/phlex/versions/1.8.3)\n- [1.7.2](https://rubygems.org/gems/phlex/versions/1.7.2)\n- [1.6.3](https://rubygems.org/gems/phlex/versions/1.6.3)\n- [1.5.3](https://rubygems.org/gems/phlex/versions/1.5.3)\n- [1.4.2](https://rubygems.org/gems/phlex/versions/1.4.2)\n\n### Workarounds\nConfiguring a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy) that does not allow [`unsafe-inline`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline) would effectively prevent this vulnerability from being exploited.","aliases":["CVE-2024-32463"],"modified":"2026-09-10T03:50:11.506169823Z","published":"2024-04-17T00:20:23Z","database_specific":{"github_reviewed_at":"2024-04-17T00:20:23Z","nvd_published_at":"2024-04-17T16:15:09Z","cwe_ids":["CWE-79","CWE-87"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32463"},{"type":"WEB","url":"https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb"},{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy"},{"type":"WEB","url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline"},{"type":"PACKAGE","url":"https://github.com/phlex-ruby/phlex"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/phlex/CVE-2024-32463.yml"}],"affected":[{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.1"}]}],"versions":["1.10.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.0"},{"fixed":"1.9.2"}]}],"versions":["1.9.0","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.8.3"}]}],"versions":["1.8.0","1.8.1","1.8.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.7.0"},{"fixed":"1.7.2"}]}],"versions":["1.7.0","1.7.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.3"}]}],"versions":["1.6.0","1.6.1","1.6.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.3"}]}],"versions":["1.5.0","1.5.1","1.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}},{"package":{"name":"phlex","ecosystem":"RubyGems","purl":"pkg:gem/phlex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2"}]}],"versions":["0.1.0","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.4.0","0.5.0","0.5.1","0.5.2","0.5.3","1.0.0","1.0.0.rc1","1.0.0.rc2","1.0.1","1.1.0","1.1.1","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-g7xq-xv8c-h98c/GHSA-g7xq-xv8c-h98c.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}]}