CVE-2024-28121

HIGH
Published Mar 12, 2024 Modified Dec 3, 2025 CWE-470

Description

stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.

Is your site exposed to CVE-2024-28121?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-470 CWE-470

Affected Products

Vendor Product
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex
stimulusreflex stimulusrelfex

References

Frequently Asked Questions

What is CVE-2024-28121? +
stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice. It has a CVSS v3.1 base score of 8.8 (HIGH).
How severe is CVE-2024-28121? +
CVE-2024-28121 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.
What products are affected by CVE-2024-28121? +
CVE-2024-28121 affects products from stimulusreflex, specifically: stimulusrelfex. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-28121? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-44174

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that …
CVE-2025-2794

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service …
CVE-2026-46562 9.8

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in …
CVE-2026-42027 9.8

Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 2.5.9, before 3.0.0-M3 Description: The ExtensionLoader.instantiateExtension(Class, String) …
CVE-2025-34393 9.8

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name …
CVE-2026-40008 9.8

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-28121 — free, no signup required.