CVE-2024-22048

    Dashboard / Vulnerabilities / CVE-2024-22048

    CVE-2024-22048

    Published: 4 Jan 2024Last Modified: 28 Oct 2026

    Summary: govuk_tech_docs XSS Vulnerability

    Details: govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.

    References: https://github.com/alphagov/tech-docs-gem/releases/tag/v3.3.1, https://rubygems.org, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22048.json, https://github.com/advisories/GHSA-x2xw-hw8g-6773, https://github.com/alphagov/tech-docs-gem/security/advisories/GHSA-x2xw-hw8g-6773, https://nvd.nist.gov/vuln/detail/CVE-2024-22048, https://vulncheck.com/advisories/vc-advisory-GHSA-x2xw-hw8g-6773, https://github.com/alphagov/tech-docs-gem/pull/323

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 2add21e41fbaf315359ce37348d245256bc256be
    Fixed -f670bf5d9f948fc668437b9757e7b52a17bbf04a

    Affected versions

    v3.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22048 | CVE-DB