Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values
Date: 2026-02
Affected: rubygems/phlex, rubygems/phlex, rubygems/phlex
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CWE: CWE-79
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

### Impact During a security audit conducted with Claude Opus 4.6 and GPT-5.3-Codex, we identified three specific ways to bypass the XSS (cross-site-scripting) protection built into Phlex. 1. The first bypass could happen if user-provided attributes with string keys were splatted into HTML tag, e.g. `div(**user_attributes)`. 2. The second bypass could happen if user-provided tag names were passed to the `tag` method, e.g. `tag(some_tag_name_from_user)`. 3. The third bypass could happen if user’s links were passed to `href` attributes, e.g. `a(href: user_provided_link)`. All three of these patterns are meant to be safe and all have now been patched. ### Patches Phlex has patched all three issues and introduced new tests that run against Safari, Firefox and Chrome. The patched versions are: - [2.4.1](https://rubygems.org/gems/phlex/versions/2.4.1) - [2.3.2](https://rubygems.org/gems/phlex/versions/2.3.2) - [2.2.2](https://rubygems.org/gems/phlex/versions/2.2.2) - [2.1.3](https://rubygems.org/gems/phlex/versions/2.1.3) - [2.0.2](https://rubygems.org/gems/phlex/versions/2.0.3) - [1.11.1](https://rubygems.org/gems/phlex/versions/1.11.1) Phlex has also patched the [`main`](https://github.com/yippee-fun/phlex) branch in GitHub. ### Workarounds If a project uses a secure CSP (content security policy) or if the application doesn’t use any of the above patterns, it is not at risk.


Mitigations:

Architectural layers (MAESTRO):