CVE-2024-26143

A vulnerability was found in actionpack ruby gem. Applications using the translate method may be susceptible to a cross-site scripting XSS attack...

Ruby on Rails: XSS when using `translate` in Action Controller (Rails 7.0, 7.1)

The vulnerability allows cross-site scripting XSS when using the translate method in Action Controller in Rails versions 7.0 and 7.1. The vulnerability was caused by the implementation of translate in Action Controller, which did not properly escape the values passed to it. The vulnerability was...

Cross site scripting

VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the viewcomponent gem. Data received via user input and passed as an...