stimulus_reflex@3.5.0-pre10 vulnerabilities

stimulus_reflex is a Build reactive applications with the Rails tooling you already know and love.

Affected versions of this package are vulnerable to Unsafe Reflection due to the handling of websocket messages that allow specifying a class_name and method_name. An attacker can manipulate the server-side behavior and potentially cause denial of service by crafting malicious websocket messages that invoke unintended methods on the server. This is particularly concerning with methods like instance_variable_set, which can be used to alter instance variables and influence the application's logic in a harmful way. Additionally, methods intended for debugging or interactive sessions, such as remote_byebug or pry, can be invoked, leading to further security implications. The vulnerability is exacerbated by the fact that the validation of method calls based on required and optional parameters does not adequately restrict access to sensitive or unintended methods.

Note:

Versions >=3.5.0.rc1 <3.5.0.rc4 contain a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution.

Upgrade stimulus_reflex to version 3.4.2, 3.5.0-rc4 or higher.