Unpatched CVE-2022-44303 - Reflected XSS about resque HOT 4 CLOSED

@jchristman hey don't mean to be splitting hairs here, but it looks like that's an issue with rescue-scheduler: https://github.com/resque/resque-scheduler

from resque.

@jchristman just a heads up, this is resolved in the latest release of resque-scheduler

This is fixed in resque-scheduler 4.10.2

Relevant PRs:
resque/resque-scheduler#780
resque/resque-scheduler#783

Thank you for shining a light on this issue. A security advisory should be coming out shortly for this issue.

from resque.

Thanks @PatrickTulskie -- looks like there is actually an untouched open issue over there at resque/resque-scheduler#761 that is directly related to this CVE. I'll close this issue since it's not this library specifically.

from resque.

Thanks for pointing that out. I'll take a look and see if I can get that sorted out and push a new release in the next few days.

from resque.