Reflex arbitrary method call in stimulus_reflex
Priority MEDIUM 43CWE-470Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
stimulus_reflex is a system to extend the capabilities of both Rails and Stimulus by intercepting user interactions and passing them to Rails over real-time websockets. In affected versions more methods than expected can be called on reflex instances. Being able to call some of them has security implications. To invoke a reflex a websocket message of the following shape is sent: `\"target\":\"[class_name]#[method_name]\",\"args\":[]`. The server will proceed to instantiate `reflex` using the provided `class_name` as long as it extends `StimulusReflex::Reflex`. It then attempts to call `method_name` on the instance with the provided arguments. This is problematic as `reflex.method method_name` can be more methods that those explicitly specified by the developer in their reflex class. A good example is the instance_variable_set method. This vulnerability has been patched in versions 3.4.2 and 3.5.0.rc4. Users unable to upgrade should: see the backing GHSA advisory for mitigation advice.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01555 75th percentileScored 2026-11-08
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed stimulus_reflex (stimulusreflex): 3.5.0.rc4, 3.4.2stimulus_reflex (RubyGems): 3.5.0.rc4, 3.4.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| stimulusreflex | stimulus_reflex | 3.5.0.rc1 to before 3.5.0.rc4; before 3.4.2 | 3.5.0.rc4, 3.4.2 | Patch available | CNA |
| — | stimulus_reflex (RubyGems) | 3.5.0.pre0 to before 3.5.0.rc4 | 3.5.0.rc4 | Patch available | GHSA-f78j-4w3g-4q65 |
| — | stimulus_reflex (RubyGems) | before 3.4.2 | 3.4.2 | Patch available | GHSA-f78j-4w3g-4q65 |
| — | stimulus_reflex (npm) | 3.5.0-pre0 to before 3.5.0-rc4 | 3.5.0-rc4 | Patch available | GHSA-f78j-4w3g-4q65 |
| — | stimulus_reflex (npm) | before 3.4.2 | 3.4.2 | Patch available | GHSA-f78j-4w3g-4q65 |
- stimulus_reflex Vendorstimulusreflex Affected 3.5.0.rc1 to before 3.5.0.rc4; before 3.4.2 Fixed in 3.5.0.rc4, 3.4.2 Patch available CNA
- stimulus_reflex (RubyGems) Vendor— Affected 3.5.0.pre0 to before 3.5.0.rc4 Fixed in 3.5.0.rc4 Patch available GHSA-f78j-4w3g-4q65
- stimulus_reflex (RubyGems) Vendor— Affected before 3.4.2 Fixed in 3.4.2 Patch available GHSA-f78j-4w3g-4q65
- stimulus_reflex (npm) Vendor— Affected 3.5.0-pre0 to before 3.5.0-rc4 Fixed in 3.5.0-rc4 Patch available GHSA-f78j-4w3g-4q65
- stimulus_reflex (npm) Vendor— Affected before 3.4.2 Fixed in 3.4.2 Patch available GHSA-f78j-4w3g-4q65
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:* | before 3.4.2 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:* | 3.5.0 pre1 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:* | 3.5.0 pre10 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:* | 3.5.0 pre2 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:* | 3.5.0 pre3 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:* | 3.5.0 pre4 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:* | 3.5.0 pre5 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:* | 3.5.0 pre6 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:* | 3.5.0 pre7 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:* | 3.5.0 pre8 | Vulnerable | stimulusreflex |
- cpe:2.3:a:stimulusreflex:stimulusrelfex:*:*:*:*:*:*:*:* Versions before 3.4.2 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre1:*:*:*:*:*:* Versions 3.5.0 pre1 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre10:*:*:*:*:*:* Versions 3.5.0 pre10 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre2:*:*:*:*:*:* Versions 3.5.0 pre2 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre3:*:*:*:*:*:* Versions 3.5.0 pre3 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre4:*:*:*:*:*:* Versions 3.5.0 pre4 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre5:*:*:*:*:*:* Versions 3.5.0 pre5 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre6:*:*:*:*:*:* Versions 3.5.0 pre6 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre7:*:*:*:*:*:* Versions 3.5.0 pre7 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre8:*:*:*:*:*:* Versions 3.5.0 pre8 Vulnerable ·stimulusreflex
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:* | 3.5.0 pre9 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:* | 3.5.0 rc1 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:* | 3.5.0 rc2 | Vulnerable | stimulusreflex |
| cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:* | 3.5.0 rc3 | Vulnerable | stimulusreflex |
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:pre9:*:*:*:*:*:* Versions 3.5.0 pre9 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc1:*:*:*:*:*:* Versions 3.5.0 rc1 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc2:*:*:*:*:*:* Versions 3.5.0 rc2 Vulnerable ·stimulusreflex
- cpe:2.3:a:stimulusreflex:stimulusrelfex:3.5.0:rc3:*:*:*:*:*:* Versions 3.5.0 rc3 Vulnerable ·stimulusreflex
Remediation
- Fix · CNA stimulus_reflex (stimulusreflex) Fixed in 3.5.0.rc4, 3.4.2
- Fix · GHSA-f78j-4w3g-4q65 stimulus_reflex (RubyGems) Fixed in 3.5.0.rc4 Advisory →
- Fix · GHSA-f78j-4w3g-4q65 stimulus_reflex (RubyGems) Fixed in 3.4.2 Advisory →
- Fix · GHSA-f78j-4w3g-4q65 stimulus_reflex (npm) Fixed in 3.5.0-rc4 Advisory →
- Fix · GHSA-f78j-4w3g-4q65 stimulus_reflex (npm) Fixed in 3.4.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28121
- 2026-10-03 Alias added: GHSA-f78j-4w3g-4q65
References
Exploit 2
Patch 1
Other 6
- https://github.com/stimulusreflex/stimulus_reflex/blob/0211cad7d60fe96838587f159d657e44cee51b9b/app/channels/stimulus_reflex/channel.rb#L83
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.4.2
- https://github.com/stimulusreflex/stimulus_reflex/releases/tag/v3.5.0.rc4
- https://github.com/stimulusreflex/stimulus_reflex/commit/d823d7348f9ca42eb6df25574f11974e4f5bc88c
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/stimulus_reflex/CVE-2024-28121.yml
- https://github.com/stimulusreflex/stimulus_reflex
Sources
- CVE-2024-28121 · CVE Program
- CVE-2024-28121 · NVD
- FIRST EPSS
- GHSA-f78j-4w3g-4q65 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences