CVE-2024-32463: Phlex-Ruby Phlex

High severity, CVSS 7.1. EPSS: 0.6% chance of exploitation in the next 30 days.

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.

Affected products

• Phlex-Ruby Phlex: from 1.10.0, before 1.10.1 (fixed in 1.10.1); from 1.9.0, before 1.9.2 (fixed in 1.9.2); from 1.8.0, before 1.8.3 (fixed in 1.8.3); from 1.7.0, before 1.7.2 (fixed in 1.7.2); from 1.6.0, before 1.6.3 (fixed in 1.6.3); from 1.5.0, before 1.5.3 (fixed in 1.5.3); …
• Ruby Fileutils: version 1.0.0 only

Published 2024-04-17. Last modified 2026-06-17.