RubyGems Package Vulnerabilities
Vulnerabilities associated with rails-html-sanitizer.
Packages
Clear package- actionpack63 vulnerabilities
- nokogiri59 vulnerabilities
- rack50 vulnerabilities
- rubygems-update25 vulnerabilities
- activerecord23 vulnerabilities
- puppet23 vulnerabilities
- activesupport17 vulnerabilities
- camaleon_cms15 vulnerabilities
- publify_core15 vulnerabilities
- rails-html-sanitizer15 vulnerabilities
- passenger14 vulnerabilities
- puma14 vulnerabilities
- actionview13 vulnerabilities
- decidim13 vulnerabilities
- fat_free_crm12 vulnerabilities
- activestorage11 vulnerabilities
- loofah11 vulnerabilities
- oj11 vulnerabilities
- rails11 vulnerabilities
- net-imap10 vulnerabilities
- ruby-saml10 vulnerabilities
- decidim-core9 vulnerabilities
- jquery-rails9 vulnerabilities
- openc39 vulnerabilities
- avo8 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-73648MEDIUM | rails-html-sanitizer: Possible XSS vulnerability with certain configurationsrails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitiz… CWE-79Aug 13, 2026 | CVSS5.1v4.0 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" … CWE-79Dec 2, 2024 | CVSS2.3v4.0 | EPSS0.581% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and … CWE-79Dec 2, 2024 | CVSS2.3v4.0 | EPSS0.435% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both expli… CWE-79Dec 2, 2024 | CVSS2.3v4.0 | EPSS0.462% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elem… CWE-79Dec 2, 2024 | CVSS2.3v4.0 | EPSS0.435% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability i… CWE-79Dec 2, 2024 | CVSS2.3v4.0 | EPSS0.463% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-23520MEDIUM | rails-html-sanitizer contains an incomplete fix for an XSS vulnerabilityrails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. This issue… CWE-79Dec 14, 2022 | CVSS6.1v3.1 | EPSS1.11% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23519HIGH | Possible XSS vulnerability with certain configurations of rails-html-sanitizerrails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is… CWE-79Dec 14, 2022 | CVSS7.2v3.1 | EPSS0.988% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23518MEDIUM | Improper neutralization of data URIs allows XSS in rails-html-sanitizerrails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4. CWE-79Dec 14, 2022 | CVSS6.1v3.1 | EPSS0.867% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-23517HIGH | Inefficient Regular Expression Complexity in rails-html-sanitizerrails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4. CWE-1333Dec 14, 2022 | CVSS7.5v3.1 | EPSS1.45% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-32209MEDIUM | Rails::Html::Sanitizer vulnerable to Cross-site Scripting# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `s… CWE-79Jun 24, 2022 | CVSS6.1v3.1 | EPSS29.4% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-3741MEDIUM | rails-html-sanitizer Cross-site Scripting vulnerabilityThere is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately. CWE-79Mar 30, 2018 | CVSS6.1v3.1 | EPSS1.26% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2015-7579MEDIUM | rails-html-sanitizer Cross-site Scripting vulnerabilityCross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class. CWE-79Feb 16, 2016 | CVSS6.1v3.0 | EPSS2.58% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2015-7580MEDIUM | rails-html-sanitizer Cross-site Scripting vulnerabilityCross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node. CWE-79Feb 16, 2016 | CVSS6.1v3.0 | EPSS2.19% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2015-7578MEDIUM | rails-html-sanitizer Cross-site Scripting vulnerabilityCross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes. CWE-79Feb 16, 2016 | CVSS6.1v3.0 | EPSS2.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |