stimulus_reflex

Version	Released
`3.5.5` patch	May 25, 2025
`3.5.4` patch	May 22, 2025
`3.5.3` patch	Dec 15, 2024
`3.5.2` patch	May 24, 2024
`3.5.1` patch	May 14, 2024
`3.5.0` minor	May 10, 2024
`3.4.2` patch	Mar 12, 2024
`3.5.0.rc4` pre	Mar 12, 2024
`3.5.0.rc3` pre 1 CVE	Jul 12, 2023
`3.5.0.rc2` pre 1 CVE	Mar 27, 2023
`3.5.0.rc1` pre 1 CVE	Mar 26, 2023
`3.5.0.pre10` pre 1 CVE	Feb 21, 2023
`3.5.0.pre9` pre 1 CVE	Apr 01, 2022
`3.5.0.pre8` pre 1 CVE	Nov 22, 2021
`3.5.0.pre7` pre 1 CVE	Oct 26, 2021
`3.5.0.pre6` pre 1 CVE	Oct 14, 2021
`3.5.0.pre5` pre 1 CVE	Oct 07, 2021
`3.5.0.pre4` pre 1 CVE	Oct 07, 2021
`3.5.0.pre3` pre 1 CVE	Oct 01, 2021
`3.5.0.pre2` pre 1 CVE	Jul 21, 2021
`3.5.0.pre1` pre 1 CVE	Jun 02, 2021
`3.5.0.pre0` pre 1 CVE	May 21, 2021
`3.4.1` patch 1 CVE	Jan 26, 2021
`3.4.0` minor 1 CVE	Dec 18, 2020
`3.4.0.pre9` pre 1 CVE	Dec 13, 2020
`3.4.0.pre8` pre 1 CVE	Dec 02, 2020
`3.4.0.pre7` pre 1 CVE	Dec 01, 2020
`3.4.0.pre6` pre 1 CVE	Nov 29, 2020
`3.4.0.pre5` pre 1 CVE	Nov 25, 2020
`3.4.0.pre4` pre 1 CVE	Nov 19, 2020
`3.4.0.pre3` pre 1 CVE	Nov 11, 2020
`3.4.0.pre2` pre 1 CVE	Nov 06, 2020
`3.4.0.pre1` pre 1 CVE	Nov 03, 2020
`3.4.0.pre0` pre 1 CVE	Nov 02, 2020
`3.3.0` minor 1 CVE	Sep 22, 2020
`3.3.0.pre6` pre 1 CVE	Sep 20, 2020
`3.3.0.pre5` pre 1 CVE	Sep 18, 2020
`3.3.0.pre4` pre 1 CVE	Sep 13, 2020
`3.3.0.pre3` pre 1 CVE	Aug 31, 2020
`3.3.0.pre2` pre 1 CVE	Jul 17, 2020
`3.3.0.pre1` pre 1 CVE	Jul 08, 2020
`3.3.0.pre0` pre 1 CVE	Jul 04, 2020
`3.2.3` patch 1 CVE	Jun 15, 2020
`3.2.2` patch 1 CVE	Jun 06, 2020
`3.2.2.pre1` pre 1 CVE	May 30, 2020
`3.2.2.pre0` pre 1 CVE	May 27, 2020
`3.2.0` minor 1 CVE	May 09, 2020
`3.2.1` patch 1 CVE	May 09, 2020
`3.2.0.pre1` pre 1 CVE	May 08, 2020
`3.2.0.pre0` pre 1 CVE	May 07, 2020

3.5.5 patch

May 25, 2025

3.5.4 patch

May 22, 2025

3.5.3 patch

Dec 15, 2024

3.5.2 patch

May 24, 2024

3.5.1 patch

May 14, 2024

3.5.0 minor

May 10, 2024

3.4.2 patch

Mar 12, 2024

3.5.0.rc4 pre

Mar 12, 2024

3.5.0.rc3 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 12, 2023

3.5.0.rc2 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 27, 2023

3.5.0.rc1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 26, 2023

3.5.0.pre10 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 21, 2023

3.5.0.pre9 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 01, 2022

3.5.0.pre8 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 22, 2021

3.5.0.pre7 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 26, 2021

3.5.0.pre6 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 14, 2021

3.5.0.pre5 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 07, 2021

3.5.0.pre4 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 07, 2021

3.5.0.pre3 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 01, 2021

3.5.0.pre2 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 21, 2021

3.5.0.pre1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 02, 2021

3.5.0.pre0 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 21, 2021

3.4.1 patch

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 26, 2021

3.4.0 minor

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 18, 2020

3.4.0.pre9 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 13, 2020

3.4.0.pre8 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 02, 2020

3.4.0.pre7 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 01, 2020

3.4.0.pre6 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 29, 2020

3.4.0.pre5 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 25, 2020

3.4.0.pre4 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 19, 2020

3.4.0.pre3 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 11, 2020

3.4.0.pre2 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 06, 2020

3.4.0.pre1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 03, 2020

3.4.0.pre0 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 02, 2020

3.3.0 minor

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 22, 2020

3.3.0.pre6 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 20, 2020

3.3.0.pre5 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 18, 2020

3.3.0.pre4 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 13, 2020

3.3.0.pre3 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 31, 2020

3.3.0.pre2 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 17, 2020

3.3.0.pre1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 08, 2020

3.3.0.pre0 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 04, 2020

3.2.3 patch

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 15, 2020

3.2.2 patch

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 06, 2020

3.2.2.pre1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 30, 2020

3.2.2.pre0 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 27, 2020

3.2.0 minor

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 09, 2020

3.2.1 patch

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 09, 2020

3.2.0.pre1 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 08, 2020

3.2.0.pre0 pre

1 CVE

CVE-2024-28121 GHSA-f78j-4w3g-4q65 Mar 12, 2024

StimulusReflex arbitrary method call

8.8 / 10

High

Network Low Low None Unchanged High High High

Summary

More methods than expected can be called on reflex instances. Being able to call some of them has security implications.

Details

To invoke a reflex a websocket message of the following shape is sent:

{ 
  "target": "[class_name]#[method_name]", 
  "args": [] 
}

The server will proceed to instantiate reflex using the provided class_name as long as it extends StimulusReflex::Reflex. It then attempts to call method_name on the instance with the provided arguments ref:

method = reflex.method method_name
required_params = method.parameters.select { |(kind, _)| kind == :req }
optional_params = method.parameters.select { |(kind, _)| kind == :opt }

if arguments.size >= required_params.size && arguments.size <= required_params.size + optional_params.size
  reflex.public_send(method_name, *arguments)
end

This is problematic as reflex.method(method_name) can be more methods than those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method.

This variable can be overwritten using the following message:

{
  "target": "ChatReflex#instance_variable_set", 
  "args": ["@user", "<admin-id>"]
}

Here are other interesting methods that were found to be available for the ChatReflex sample reflex

remote_byebug: bind a debugging server
pry: drop the process in a REPL session

All in all, only counting :req and :opt parameters helps. For example around version 1.0 only .arity was checked which allowed access to the system method (.arity == -1)

{
  "target": "ChatReflex#system", 
  "args": ["[command here]"]
}

Using public_send instead of send does not help but the following payloads do not work since :rest parameters are not counted in the current version

{
  "target": "ChatReflex#send", 
  "args": ["system", "[command here]"] 
}

{ 
  "target": "ChatReflex#instance_eval", 
  "args": ["system('[command here]')"]
}

Pre-versions of 3.5.0 added a render_collection method on reflexes with a :req parameter. Calling this method could lead to arbitrary code execution:

{
  "target": "StimulusReflex::Reflex#render_collection", 
  "args": [
    { "inline":  "<% system('[command here]') %>" }
  ]
}

Patches

Patches are available on RubyGems and on NPM.

The patched versions are:

Workaround

You can add this guard to mitigate the issue if running an unpatched version of the library.

1.) Make sure all your reflexes inherit from the ApplicationReflex class 2.) Add this before_reflex callback to your app/reflexes/application_reflex.rb file:

class ApplicationReflex < StimulusReflex::Reflex
  before_reflex do
    ancestors = self.class.ancestors[0..self.class.ancestors.index(StimulusReflex::Reflex) - 1]
    allowed = ancestors.any? { |a| a.public_instance_methods(false).any?(method_name.to_sym) }

    raise ArgumentError.new("Reflex method '#{method_name}' is not defined on class '#{self.class.name}' or on any of its ancestors") if !allowed
  end
end

Affected versions


          3.5.0.pre0


          3.5.0.pre1


          3.5.0.pre10


          3.5.0.pre2


          3.5.0.pre3


          3.5.0.pre4


          3.5.0.pre5


          3.5.0.pre6


          3.5.0.pre7


          3.5.0.pre8


          3.5.0.pre9


          3.5.0.rc1

+ 73 more


            3.5.0.rc2


            3.5.0.rc3


            0.1.0


            0.1.1


            0.1.10


            0.1.12


            0.1.2


            0.1.3


            0.1.4


            0.1.5


            0.1.6


            0.1.7


            0.1.8


            0.1.9


            0.2.0


            0.3.0


            0.3.1


            0.3.2


            0.3.3


            1.0.0


            1.0.1


            1.0.2


            1.1.0


            1.1.1


            2.0.0


            2.0.1


            2.0.2


            2.1.0


            2.1.1


            2.1.2


            2.1.3


            2.1.4


            2.1.5


            2.1.6


            2.1.7


            2.1.8


            2.1.9


            2.2.0


            2.2.1


            2.2.2


            2.2.3


            3.0.0


            3.1.2


            3.1.3


            3.1.4


            3.2.0


            3.2.0.pre0


            3.2.0.pre1


            3.2.1


            3.2.2


            3.2.2.pre0


            3.2.2.pre1


            3.2.3


            3.3.0


            3.3.0.pre0


            3.3.0.pre1


            3.3.0.pre2


            3.3.0.pre3


            3.3.0.pre4


            3.3.0.pre5


            3.3.0.pre6


            3.4.0


            3.4.0.pre0


            3.4.0.pre1


            3.4.0.pre2


            3.4.0.pre3


            3.4.0.pre4


            3.4.0.pre5


            3.4.0.pre6


            3.4.0.pre7


            3.4.0.pre8


            3.4.0.pre9


            3.4.1

Fixed in


          3.4.2


          3.5.0.rc4

References

Updated Sep 10, 2026 · Source: OSV.dev

May 07, 2020

Activity

Details