# phlex (RubyGems) vulnerabilities 3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://rubygems.org/gems/phlex ## Advisories (3) ### [CVE-2024-32970](https://cve.now/CVE-2024-32970): Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex - Severity: High 7.1 - Published: Apr 30, 2024 - Affected: fixed in 1.9.3; from 1.10.0, fixed in 1.10.2. ### [CVE-2024-32463](https://cve.now/CVE-2024-32463): phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of \`href\` attributes on \`\\` tags - Severity: High 7.1 - Published: Apr 17, 2024 - Affected: from 1.10.0, fixed in 1.10.1; from 1.9.0, fixed in 1.9.2; from 1.8.0, fixed in 1.8.3; from 1.7.0, fixed in 1.7.2; from 1.6.0, fixed in 1.6.3; from 1.5.0, fixed in 1.5.3; fixed in 1.4.2. ### [CVE-2024-28199](https://cve.now/CVE-2024-28199): Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex - Severity: High 7.1 - Published: Mar 11, 2024 - Affected: from 1.9.0, fixed in 1.9.1; from 1.8.0, fixed in 1.8.2; from 1.7.0, fixed in 1.7.1; from 1.6.0, fixed in 1.6.2; from 1.5.0, fixed in 1.5.2; from 1.4.0, fixed in 1.4.1; from 1.3.0, fixed in 1.3.3; from 1.2.0, fixed in 1.2.2; from 1.1.0, fixed in 1.1.1; fixed in 1.0.1. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/rubygems/phlex Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.