Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component

TRUNG BÌNH 6.1CVE-2022-24722 · GHSA-cm9w-c4rj-r2cf · Công bố 02/03/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-24722 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng view_component, viewcomponent (github).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.31.2, 2.49.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
view_component RubyGems	`≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1`	`2.31.22.49.1`
viewcomponent github	`≥ 2.31.0, < 2.31.2≥ 2.32.0, < 2.49.1`	`2.31.22.49.1`

Mô tả

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the translate method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the translate function, or sanitize the inputs before passing them.

For more information

If you have any questions or comments about this advisory:

Open an issue in the github/view_component project

Mô tả của NVD

VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.