This vulnerability is classified as CWE-352, Cross-Site Request Forgery, in Pure Chat by Ruby Pure Chat, affecting versions through 2.22. It allows an attacker to trick authenticated users into submitting unauthorized requests to the application. The CVSS 3.1 vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required, but requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact. No official fix or mitigation details are currently available.

The vulnerability could allow an attacker to perform limited unauthorized actions on behalf of an authenticated user, potentially modifying data or application state. There is no impact on confidentiality or availability. No known exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unsolicited links or requests that could trigger unwanted actions in Pure Chat. No official mitigation or temporary fix has been published by the vendor.