CVE-2022-24722
Description
VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.
How to fix
- github viewcomponent2.31.2, 2.49.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github viewcomponent | 2.31.0 ≤ v < 2.31.2, 2.32.0 ≤ v < 2.49.1 | 2.31.2, 2.49.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.