~ / search / GHSA-ch3h-j2vf-95pv

GHSA-ch3h-j2vf-95pv

XSS Vulnerability in Action View tag helpers

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-27777

Packages

EcosystemPackageAffectedFixed in
RubyGems actionview < 5.2.7.1 5.2.7.1
RubyGems actionview >= 6.0.0, < 6.0.4.8 6.0.4.8
RubyGems actionview >= 6.1.0, < 6.1.5.1 6.1.5.1
RubyGems actionview >= 7.0.0, < 7.0.2.4 7.0.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777. Versions Affected: ALL Not affected: NONE Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1 ## Impact If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability. Impacted code will look something like this: ``` check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' }) ``` Where the "malicious_input" variable contains untrusted data. All users running an affected release should either upgrade or use one of the workarounds immediately. ## Releases The FIXED releases are available at the normal locations. ## Workarounds Escape the untrusted data before using it as a key for tag helper methods.

References

External links from the advisory. They lead to third-party sites.