Skip to content
  • Zack Deveau's avatar
    73009ea5
    Ignore certain data-* attributes in rails-ujs when element is contenteditable · 73009ea5
    Zack Deveau authored 
    There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to occur
when pasting malicious HTML content from the clipboard that includes
a data-method, data-disable-with or data-remote attribute.

[CVE-2023-23913]
    73009ea5
    Ignore certain data-* attributes in rails-ujs when element is contenteditable
    Zack Deveau authored 
    There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to occur
when pasting malicious HTML content from the clipboard that includes
a data-method, data-disable-with or data-remote attribute.

[CVE-2023-23913]