CVE-2024-26143

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

• CWE-79
• CWE-79

• https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947Exploit, Vendor Advisory
• https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782ccPatch
• https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9ePatch
• https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4Exploit, Vendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.ymlExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240510-0004/Third Party Advisory
• https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947Exploit, Vendor Advisory
• https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782ccPatch
• https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9ePatch
• https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4Exploit, Vendor Advisory
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.ymlExploit, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20240510-0004/Third Party Advisory

Published

Feb 27, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26138The XWiki licensor application, which manages and enforce ap…5.3
• CVE-2024-26139OpenCTI is an open source platform allowing organizations to…8.1
• CVE-2024-2614Memory safety bugs present in Firefox 123, Firefox ESR 115.8…8.8
• CVE-2024-26140com.yetanalytics/lrs is the Yet Analytics Core LRS Library. …6.1
• CVE-2024-26141Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-26142Rails is a web-application framework. Starting in version 7.…7.5
• CVE-2024-26144Rails is a web-application framework. Starting with version …5.3
• CVE-2024-26145Discourse Calendar adds the ability to create a dynamic cale…4.3
• CVE-2024-26146Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-26147Helm is a package manager for Charts for Kubernetes. Version…7.5
• CVE-2024-26148Querybook is a user interface for querying big data. Prior t…6.1
• CVE-2024-26149Vyper is a pythonic Smart Contract Language for the ethereum…5.3