Every CVESearch/Get API key

GHSA-w67g-2h6v-vjgq

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

7.1 HighFix available

GHSA-w67g-2h6v-vjgq is a high vulnerability (CVSS 7.1) in phlex, published February 6, 2026. No source lists public exploit code. Fixed in phlex 2.4.1.

What does this mean?
Severity
7.1 HighCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.4.1phlex +11 more

Description

Impact

During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex.

  1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. div(**user_attributes).
  2. The second bypass could happen if user-provided tag names were passed to the tag method, e.g. tag(some_tag_name_from_user).
  3. The third bypass could happen if user’s links were passed to href attributes, e.g. a(href: user_provided_link).

All three of these patterns are meant to be safe and all have now been patched.

Patches

Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome.

The patched versions are:

Phlex has also patched the main branch in GitHub.

Workarounds

If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
Low
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
phlex
RubyGems
2.4.0.beta1 up to 2.4.1
2.4.1
phlex
RubyGems
2.3.0 up to 2.3.2
2.3.2
phlex
RubyGems
2.2.0 up to 2.2.2
2.2.2
phlex
RubyGems
2.1.0 up to 2.1.3
2.1.3
phlex
RubyGems
2.0.0.beta1 up to 2.0.2
2.0.2
phlex
RubyGems
before 1.11.1
1.11.1
phlex
RubyGems
2.4.0.beta1 up to 2.4.1, plus listed versions
2.4.02.4.0.beta2
2.4.1
phlex
RubyGems
2.3.0 up to 2.3.2, plus listed versions
2.3.1
2.3.2
phlex
RubyGems
2.2.0 up to 2.2.2, plus listed versions
2.2.1
2.2.2
phlex
RubyGems
2.1.0 up to 2.1.3, plus listed versions
2.1.12.1.2
2.1.3
phlex
RubyGems
2.0.0.beta1 up to 2.0.2, plus listed versions
2.0.02.0.0.beta22.0.0.rc12.0.0.rc22.0.1
2.0.2
phlex
RubyGems
before 1.11.1, plus listed versions
0.1.00.2.00.2.10.2.20.3.0
Show 45 moreShow less
0.3.10.3.20.4.00.5.00.5.10.5.20.5.31.0.01.0.0.rc11.0.0.rc21.0.11.1.01.1.11.10.01.10.11.10.21.10.31.11.01.2.01.2.11.2.21.3.01.3.11.3.21.3.31.4.01.4.11.4.21.5.01.5.11.5.21.5.31.6.01.6.11.6.21.6.31.7.01.7.11.7.21.8.01.8.11.8.21.8.31.9.01.9.1
1.11.1

What each source reports

GitHub Advisories Score used7.1

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Impact

During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex.

  1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. div(**user_attributes).
  2. The second bypass could happen if user-provided tag names were passed to the tag method, e.g. tag(some_tag_name_from_user).
  3. The third bypass could happen if user’s links were passed to href attributes, e.g. a(href: user_provided_link).

All three of these patterns are meant to be safe and all have now been patched.

Patches

Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome.

The patched versions are:

Phlex has also patched the main branch in GitHub.

Workarounds

If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.

Record
GHSA-w67g-2h6v-vjgq
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV7.1

Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

Impact

During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex.

  1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. div(**user_attributes).
  2. The second bypass could happen if user-provided tag names were passed to the tag method, e.g. tag(some_tag_name_from_user).
  3. The third bypass could happen if user’s links were passed to href attributes, e.g. a(href: user_provided_link).

All three of these patterns are meant to be safe and all have now been patched.

Patches

Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome.

The patched versions are:

Phlex has also patched the main branch in GitHub.

Workarounds

If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.

Record
GHSA-w67g-2h6v-vjgq
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

Left out here: 2 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open