CVE-2024-32463

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting (XSS) vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the `javascript:` URL scheme in the `href` attribute of an `<a>` tag could be bypassed with tab `\t` or newline `\n` characters between the characters of the protocol, e.g. `java\tscript:`. This vulnerability is fixed in 1.10.1, 1.9.2, 1.8.3, 1.7.2, 1.6.3, 1.5.3, and 1.4.2. Configuring a Content Security Policy that does not allow `unsafe-inline` would effectively prevent this vulnerability from being exploited.

• CWE-79

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
• https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
• https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy#unsafe-inline
• https://github.com/phlex-ruby/phlex/commit/9e3f5b980655817993682e409cbda72956d865cb
• https://github.com/phlex-ruby/phlex/security/advisories/GHSA-g7xq-xv8c-h98c

Published

Apr 17, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32458FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-32459FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-3246The LiteSpeed Cache plugin for WordPress is vulnerable to Cr…5.4
• CVE-2024-32460FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-32461LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…8.8
• CVE-2024-32462Flatpak is a system for building, distributing, and running …8.4
• CVE-2024-32464Action Text brings rich text content and editing to Rails. I…6.1
• CVE-2024-32465Git is a revision control system. The Git project recommends…7.8
• CVE-2024-32466Tolgee is an open-source localization platform. For the `/v2…4.3
• CVE-2024-32467MeterSphere is an open source continuous testing platform. P…6.5
• CVE-2024-32468Deno is a runtime for JavaScript and TypeScript written in r…5.4
• CVE-2024-32469Decidim is a participatory democracy framework. The paginati…7.1