CVE-2022-24722

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

VIewComponent is a framework for building view components in Ruby on Rails. Versions prior to 2.31.2 and 2.49.1 contain a cross-site scripting vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display. Versions 2.31.2 and 2.49.1 have been released and fully mitigate the vulnerability. As a workaround, avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
github	view_component	>= 2.31.0, < 2.31.2; >= 2.32.0, < 2.49.1

References

https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9Patch, Third Party Advisory
https://github.com/github/view_component/releases/tag/v2.31.2Third Party Advisory
https://github.com/github/view_component/releases/tag/v2.49.1Third Party Advisory
https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cfThird Party Advisory
https://github.com/github/view_component/commit/3f82a6e62578ff6f361aba24a1feb2caccf83ff9Patch, Third Party Advisory
https://github.com/github/view_component/releases/tag/v2.31.2Third Party Advisory
https://github.com/github/view_component/releases/tag/v2.49.1Third Party Advisory
https://github.com/github/view_component/security/advisories/GHSA-cm9w-c4rj-r2cfThird Party Advisory

Timeline

Published: Mar 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247235.3URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol CVE-2022-247249.8cmark-gfm is GitHub's extended version of the C reference implementation of CommonMark. Prior to versions 0.29.0.gfm.3 and 0.28.3.gfm.21, an CVE-2022-247255.5Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix sys CVE-2022-247267.5Istio is an open platform to connect, manage, and secure microservices. In affected versions the Istio control plane, istiod, is vulnerable CVE-2022-247285.4CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module CVE-2022-247297.5CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dia CVE-2022-24734.8The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in ver CVE-2022-247306.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.3.0 but before versions 2.1.11, 2.CVE-2022-247314.9Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 1.5.0 but before versions 2.1.11, 2.CVE-2022-247328.8Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or accou CVE-2022-247336.1Sylius is an open source eCommerce platform. Prior to versions 1.9.10, 1.10.11, and 1.11.2, it is possible for a page controlled by an attac CVE-2022-247347.2MyBB is a free and open source forum software. In affected versions the Admin CP's Settings management module does not validate setting type