Which versions of Publify are affected by CVE-2024-39311?

CVE-2024-39311 is a low-severity vulnerability in Publify involving cross-site scripting (CVSS 1.8).. A patch is available.

Is there a public PoC exploit available for CVE-2024-39311?

Yes, a public proof-of-concept exploit is available for CVE-2024-39311. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-39311?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

Publify CVE-2024-39311

Q: What is the CVSS score of CVE-2024-39311?

CVE-2024-39311 has a CVSS 4.0 base score of 1.8 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Cross-site Scripting (XSS) (CWE-79)

2025-03-28 security-advisories@github.com

XSS Publify Publify Core

1.8

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

1.8 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:33 vuln.today

PoC Detected

Apr 14, 2025 - 14:24 vuln.today

Public exploit code

CVE Published

Mar 28, 2025 - 15:15 nvd

LOW 1.8

DescriptionGitHub Advisory

Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the publify_core rubygem, publisher on a publify application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the publify_core rubygem fix the issue.

AnalysisAI

Publify is a self hosted Web publishing platform on Rails. Rated low severity (CVSS 1.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. Publify is a self hosted Web publishing platform on Rails. Prior to version 10.0.1 of Publify, corresponding to versions prior to 10.0.2 of the publify_core rubygem, publisher on a publify application is able to perform a cross-site scripting (XSS) attack on an administrator using the redirect functionality. The exploitation of this XSS vulnerability requires the administrator to click a malicious link. An attack could attempt to hide their payload by using HTML, or other encodings, as to not make it obvious to an administrator that this is a malicious link. A publisher may attempt to use this vulnerability to escalate their privileges and become an administrator. Version 10.0.1 of Publify and version 10.0.2 of the publify_core rubygem fix the issue. Affected products include: Publify, Publify Publify Core. Version information: version 10.0.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.