Medium severity6.1NVD Advisory· Published Jun 4, 2024· Updated Jun 17, 2026
CVE-2024-32464
CVE-2024-32464
Description
Action Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
actiontextRubyGems | >= 7.1.0, < 7.1.3.4 | 7.1.3.4 |
actiontextRubyGems | >= 7.2.0.beta1, < 7.2.0.beta2 | 7.2.0.beta2 |
Affected products
5- ghsa-coords2 versions
>= 7.1.0, < 7.1.3.4+ 1 more
- (no CPE)range: >= 7.1.0, < 7.1.3.4
- (no CPE)range: >= 7.1.0, < 7.1.4
>= 7.1.0, < 7.1.3.4+ 2 more
- (no CPE)range: >= 7.1.0, < 7.1.3.4
- cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*range: >=7.1.0,<7.1.3.4
- cpe:2.3:a:rubyonrails:rails:7.2.0:beta1:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
5- github.com/rails/rails/commit/e215bf3360e6dfe1497c1503a495e384ed6b0995nvdPatchWEB
- github.com/advisories/GHSA-prjp-h48f-jgf6ghsaADVISORY
- github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-32464ghsaADVISORY
- github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-32464.ymlghsaWEB
News mentions
0No linked articles in our index yet.