GHSA-w67g-2h6v-vjgq Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values

• RubyGems phlex: >= 2.4.0.beta1, < 2.4.1 → fixed in 2.4.1 • RubyGems phlex: >= 2.3.0, < 2.3.2 → fixed in 2.3.2 • RubyGems phlex: >= 2.2.0, < 2.2.2 → fixed in 2.2.2 • RubyGems phlex: >= 2.1.0, < 2.1.3 → fixed in 2.1.3 • RubyGems phlex: >= 2.0.0.beta1, < 2.0.2 → fixed in 2.0.2 • RubyGems phlex: < 1.11.1 → fixed in 1.11.1

Impact During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex. 1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. `div(**user_attributes)`. 2. The second bypass could happen if user-provided tag names were passed to the `tag` method, e.g. `tag(some_tag_name_from_user)`. 3. The third bypass could happen if user’s links were passed to `href` attributes, e.g. `a(href: user_provided_link)`. All three of these patterns are meant to be safe and all have now been patched. Patches Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome. The patched versions are: • 2.4.1 • 2.3.2 • 2.2.2 • 2.1.3 • 2.0.2 • 1.11.1 Phlex has also patched the `main` branch in GitHub. Workarounds If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.