Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2020-36624: Ahorner Text-Helpers 1.0.x Allows Malicious Link to Open Untrusted Website
CVE-2020-36624 · published 3 years ago
Summary
A critical vulnerability in Ahorner Text-Helpers version 1.0.x allows an attacker to trick users into visiting an untrusted website, potentially leading to security issues. This affects the Translation feature of the library. To fix this, update to version 1.1.0 or later.
What to do
- Update andrew horner text_helpers to version 1.2.0.
- Update texthelpers_project texthelpers to version 1.1.0 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | andrew horner | text_helpers |
>= 1.1.0, < 1.2.0 Fix: upgrade to 1.2.0
|
| – | texthelpers_project | texthelpers |
< 1.1.0 cpe:2.3:a:texthelpers_project:texthelpers:*:*:*:*:*:*:*:* |
Original advisory text
A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulatio...
A vulnerability was found in ahorner text-helpers up to 1.0.x. It has been declared as critical. This vulnerability affects unknown code of the file lib/text_helpers/translation.rb. The manipulation of the argument link leads to use of web link to untrusted target with window.opener access. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to address this issue. The name of the patch is 184b60ded0e43c985788582aca2d1e746f9405a3. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216520.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-36624
- https://github.com/ahorner/text-helpers/pull/19
- https://github.com/ahorner/text-helpers/commit/184b60ded0e43c985788582aca2d1e746...
- https://github.com/ahorner/text-helpers/releases/tag/v1.2.0
- https://vuldb.com/?id.216520
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/text_helpers/CVE-20...
- https://github.com/ahorner/text-helpers/releases/tag/v1.1.0
- https://github.com/advisories/GHSA-74hc-57m5-83ch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-266Incorrect Privilege Assignment
CWE-1022Use of Web Link to Untrusted Target with window.opener Access
Timeline
Published22 Dec 2022
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta