GHSA-w67g-2h6v-vjgq

Suggest an improvement
Source
https://github.com/advisories/GHSA-w67g-2h6v-vjgq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-w67g-2h6v-vjgq
Published
2026-02-06T19:35:09Z
Modified
2026-02-06T20:58:00.573179Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N CVSS Calculator
Summary
Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values
Details

Impact

During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex.

  1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. div(**user_attributes).
  2. The second bypass could happen if user-provided tag names were passed to the tag method, e.g. tag(some_tag_name_from_user).
  3. The third bypass could happen if user’s links were passed to href attributes, e.g. a(href: user_provided_link).

All three of these patterns are meant to be safe and all have now been patched.

Patches

Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome.

The patched versions are:

Phlex has also patched the <code>main</code> branch in GitHub.

Workarounds

If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2026-02-06T19:35:09Z",
    "severity": "HIGH",
    "github_reviewed": true
}
References

Affected packages

RubyGems
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.4.0.beta1
Fixed
2.4.1

Affected versions

2.*
2.4.0.beta1
2.4.0.beta2
2.4.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.3.0
Fixed
2.3.2

Affected versions

2.*
2.3.0
2.3.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.2

Affected versions

2.*
2.2.0
2.2.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1.0
Fixed
2.1.3

Affected versions

2.*
2.1.0
2.1.1
2.1.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0.beta1
Fixed
2.0.2

Affected versions

2.*
2.0.0.beta1
2.0.0.beta2
2.0.0.rc1
2.0.0.rc2
2.0.0
2.0.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"
phlex

Package

Name
phlex
Purl
pkg:gem/phlex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.11.1

Affected versions

0.*
0.1.0
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.4.0
0.5.0
0.5.1
0.5.2
0.5.3
1.*
1.0.0.rc1
1.0.0.rc2
1.0.0
1.0.1
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.3.0
1.3.1
1.3.2
1.3.3
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
1.6.0
1.6.1
1.6.2
1.6.3
1.7.0
1.7.1
1.7.2
1.8.0
1.8.1
1.8.2
1.8.3
1.9.0
1.9.1
1.9.2
1.9.3
1.10.0
1.10.1
1.10.2
1.10.3
1.11.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-w67g-2h6v-vjgq/GHSA-w67g-2h6v-vjgq.json"