{"id":"CVE-2024-26143","aliases":["BIT-rails-2024-26143","EUVD-2024-0589","GHSA-9822-6m93-xqf4","UBUNTU-CVE-2024-26143","openSUSE-SU-2024:14067-1","openSUSE-SU-2024:14074-1","openSUSE-SU-2025:15110-1","openSUSE-SU-2025:15124-1"],"status":"published","title":"Rails Possible XSS Vulnerability in Action Controller","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01034,"percentile":0.64302,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-02-27T15:33:54Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["7.0.8.1","7.1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"rails","fixed_in":["7.0.8.1","7.1.3.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rails","fixed_in":["7.0.9","7.1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rails","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.9"},{"introduced":"7.1.0"},{"fixed":"7.1.4"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.1"}]}],"versions":["7.1.0","7.1.1","7.1.2","7.1.3"]},{"source":"osv","ecosystem":"RubyGems","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.1"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8"]},{"source":"osv","ecosystem":"RubyGems","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.1"}]}],"versions":["7.1.0","7.1.1","7.1.2","7.1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8}],"products":[{"vendor":"rails","product":"rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-9822-6m93-xqf4","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","web","advisory","report"]},{"url":"https://github.com/rails/rails/commit/4c83b331092a79d58e4adffe4be5f250fa5782cc","tags":["x_refsource_MISC","x_transferred","Patch","web","fix","report"]},{"url":"https://github.com/rails/rails/commit/5187a9ef51980ad1b8e81945ebe0462d28f84f9e","tags":["x_refsource_MISC","x_transferred","Patch","web","fix","report"]},{"url":"https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947","tags":["x_refsource_MISC","x_transferred","Exploit","Vendor Advisory","web","report"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-26143.yml","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0004/","tags":["x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26143","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240510-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9822-6m93-xqf4"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26143.json","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-26143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26143","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47887","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47889","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-26143","title":"Rails Possible XSS Vulnerability in Action Controller","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-02-27T15:33:54.643Z","modified":"2025-02-13T17:41:06.38Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-0589","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-02-27T15:33:54Z","modified":"2025-02-13T17:41:06Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:46.532099Z"}],"ghsa":[{"id":"GHSA-9822-6m93-xqf4","title":"Rails has possible XSS Vulnerability in Action Controller","description":"# Possible XSS Vulnerability in Action Controller\n\nThere is a possible XSS vulnerability when using the translation helpers\n(`translate`, `t`, etc) in Action Controller. This vulnerability has been\nassigned the CVE identifier CVE-2024-26143.\n\nVersions Affected:  \u003e= 7.0.0.\nNot affected:       \u003c 7.0.0\nFixed Versions:     7.1.3.1, 7.0.8.1\n\nImpact\n------\nApplications using translation methods like `translate`, or `t` on a\ncontroller, with a key ending in \"_html\", a `:default` key which contains\nuntrusted user input, and the resulting string is used in a view, may be\nsusceptible to an XSS vulnerability.\n\nFor example, impacted code will look something like this:\n\n```ruby\nclass ArticlesController \u003c ApplicationController\n  def show  \n    @message = t(\"message_html\", default: untrusted_input)\n    # The `show` template displays the contents of `@message`\n  end\nend\n```\n\nTo reiterate the pre-conditions, applications must:\n\n* Use a translation function from a controller (i.e. _not_ I18n.t, or `t` from\n  a view)\n* Use a key that ends in `_html`\n* Use a default value where the default value is untrusted and unescaped input\n* Send the text to the victim (whether that's part of a template, or a\n  `render` call)\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n*  7-0-translate-xss.patch - Patch for 7.0 series\n*  7-1-translate-xss.patch - Patch for 7.1 series\n\nCredits\n-------\n\nThanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the patch and fix!","status":"published","published":"2024-02-27T21:41:12Z","modified":"2026-03-14T05:09:24Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2024-26143","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-02-27T16:15:46.8Z","modified":"2026-06-17T07:17:11.337Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-26143","title":"Rails Possible XSS Vulnerability in Action Controller","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-02-27T15:33:54.643Z","modified":"2026-10-28T02:30:29.174412165Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"GHSA-9822-6m93-xqf4","title":"Rails has possible XSS Vulnerability in Action Controller","description":"# Possible XSS Vulnerability in Action Controller\n\nThere is a possible XSS vulnerability when using the translation helpers\n(`translate`, `t`, etc) in Action Controller. This vulnerability has been\nassigned the CVE identifier CVE-2024-26143.\n\nVersions Affected:  \u003e= 7.0.0.\nNot affected:       \u003c 7.0.0\nFixed Versions:     7.1.3.1, 7.0.8.1\n\nImpact\n------\nApplications using translation methods like `translate`, or `t` on a\ncontroller, with a key ending in \"_html\", a `:default` key which contains\nuntrusted user input, and the resulting string is used in a view, may be\nsusceptible to an XSS vulnerability.\n\nFor example, impacted code will look something like this:\n\n```ruby\nclass ArticlesController \u003c ApplicationController\n  def show  \n    @message = t(\"message_html\", default: untrusted_input)\n    # The `show` template displays the contents of `@message`\n  end\nend\n```\n\nTo reiterate the pre-conditions, applications must:\n\n* Use a translation function from a controller (i.e. _not_ I18n.t, or `t` from\n  a view)\n* Use a key that ends in `_html`\n* Use a default value where the default value is untrusted and unescaped input\n* Send the text to the victim (whether that's part of a template, or a\n  `render` call)\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThere are no feasible workarounds for this issue.\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe two supported release series. They are in git-am format and consist of a\nsingle changeset.\n\n*  7-0-translate-xss.patch - Patch for 7.0 series\n*  7-1-translate-xss.patch - Patch for 7.1 series\n\nCredits\n-------\n\nThanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the patch and fix!","status":"published","published":"2024-02-27T21:41:12Z","modified":"2026-06-08T23:45:17.847969876Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:43.524801Z"},{"id":"UBUNTU-CVE-2024-26143","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-02-27T16:15:00Z","modified":"2026-10-17T12:56:43.783895976Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"BIT-rails-2024-26143","title":"Rails Possible XSS Vulnerability in Action Controller","description":"Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in \"_html\", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.","status":"published","published":"2024-12-20T09:50:15.432Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"openSUSE-SU-2024:14067-1","title":"ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T04:00:08.348611Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14074-1","title":"ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T02:52:31.850939Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15110-1","title":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:49:58.777457Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15124-1","title":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:52:20.531012Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}