CVE catalog

CVE-2024-26143

rails: CVE-2024-26143

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.03% · Oct 25, 2026

Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate, or t on a controller, with a key ending in "_html", a :default key which contains untrusted user input, and the resulting string is used in a view, may be susceptible to an XSS vulnerability. The vulnerability is fixed in 7.1.3.1 and 7.0.8.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrailssid2:7.2.4+dfsg-2not affected
Debianrailsforky2:7.2.4+dfsg-1not affected
Debianrailstrixie2:7.2.2.2+dfsg-2~deb13u1not affected
Debianrailstrixie-security2:7.2.2.2+dfsg-2~deb13u2not affected
Debianrailsbookworm2:6.1.7.10+dfsg-1~deb12u2not affected
Debianrailsbookworm-security2:6.1.7.10+dfsg-1~deb12u3not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianrailssourcesidNot affectedunimportantNot reportedNot reported
DebianrailssourceforkyNot affectedunimportantNot reportedNot reported
DebianrailssourcetrixieNot affectedunimportantNot reportedNot reported
DebianrailssourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]