CVE-2024-26143: 
Ruby vulnerability analysis and mitigation

CVE-2024-26143 is a Cross-Site Scripting (XSS) vulnerability in Ruby on Rails, discovered in February 2024. The vulnerability affects Rails versions 7.0.0 and later, with fixes available in versions 7.1.3.1 and 7.0.8.1. The issue exists in the translation helpers (translate, t) within Action Controller when handling certain translation operations (Rails Advisory, GitHub Advisory).

The vulnerability occurs when using translation methods like translate or t on a controller with specific conditions: the key must end in '_html', contain a :default key with untrusted user input, and the resulting string must be used in a view. The issue has been assigned a CVSS v3.1 score of 6.1 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility with low attack complexity (NVD).

When successfully exploited, this vulnerability could lead to Cross-Site Scripting attacks, potentially resulting in the disclosure of sensitive information or the addition/modification of data when untrusted input is processed through the translation helpers (NetApp Advisory).

The vulnerability requires specific conditions to be exploited: the application must use a translation function from a controller (not I18n.t or t from a view), use a key ending in '_html', have a default value containing untrusted and unescaped input, and send the text to the victim through a template or render call (GitHub Advisory).

There are no feasible workarounds for this vulnerability. The recommended mitigation is to upgrade to the fixed versions: Rails 7.1.3.1 or 7.0.8.1. The fixes are available through the standard distribution channels (Rails Advisory).