CVE-2018-3740

HIGH

Sanitize < 4.6.0 - XSS

Title source: rule
STIX 2.1

Description

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

References (4)

Core 4
Core References
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2018/dsa-4358
Issue Tracking, Third Party Advisory x_refsource_confirm
https://github.com/rgrove/sanitize/issues/176

Scores

CVSS v3 7.5
EPSS 0.0025
EPSS Percentile 48.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-20 CWE-79
Status published
Products (2)
rubygems/sanitize 3.0.0 - 4.6.3RubyGems
sanitize_project/sanitize < 4.6.0
Published Mar 30, 2018
Tracked Since Feb 18, 2026