onyx --cves cve-2024-26143
CVE-2024-26143
- score
- <0.1
- cvss
- 6.1
- epss
- 1.0%
- published
- 2024-02-27
- kev added
- —
- first seen
Rails contains a reflected XSS caused by translation helpers in Action Controller when using translation methods like translate or t with keys ending in '_html' and untrusted user input in default, letting attackers execute arbitrary scripts in views, exploit requires application to use these translation methods with untrusted input.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml
Exploit availability
Weaknesses
References 6
- https://security.netapp.com/advisory/ntap-20240510-0004/
- https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
- https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc
- https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e
- https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml