Threats tagged 'ghsa-v6rj-xm57-3p59'

A cross-site scripting (XSS) vulnerability exists in the ActionView::Helpers::TextHelper#highlight method of the Action View component in Ruby on Rails. The vulnerability arises when a user-supplied phrase is substituted into a custom :highlighter string inside a quoted attribute without proper escaping, potentially allowing injection of malicious attributes and XSS. The default highlighter and block form are not affected. Fixed versions properly escape matched groups to prevent this issue.