CVE-2024-32464mediumCWE-79CWE-80

CVE-2024-32464: medium-severity vulnerability in rails

ActionText ContentAttachment can Contain Unsanitized HTML

Published · Updated

Follow this CVE+ Monitor rails+ Monitor actiontext

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.4%
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
rails · rails
Related CVEs — rails

In the same product, most dangerous first.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 30.1%CVE-2022-23633HIGHExposure of sensitive information in Action PackEPSS 2.2%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.3%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%