AIKIDO-2026-663658

rails-html-sanitizer is vulnerable to Cross-site Scripting (XSS)

Cross-site Scripting (XSS)GHSA-cj75-f6xr-r4g7 Published 4 days ago

Medium Risk

This Affects:

rails-html-sanitizer

1.0.3 - 1.7.0

Fixed in 1.7.1

Are you affected? Scan for Free

TL;DR

Affected versions of rails-html-sanitizer are vulnerable to Cross-site Scripting (XSS) because Rails::HTML::PermitScrubber only restricted the xlink:href attribute on SVG reference elements in SVG_ALLOW_LOCAL_HREF to local, same-document references. Browsers also accept a plain href attribute per the SVG 2 spec, so elements such as <use> and <feImage> could reference arbitrary external documents. That can lead to rendering external SVG content (including scripts in same-origin cases) or loading external images for tracking when allowed tags are overridden to include these SVG elements.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you override the allowed tags to include an SVG reference element such as use or feImage. Applications using the default allowed tags are not affected.

Background info

rails-html-sanitizer is vulnerable to Cross-site Scripting (XSS) in versions 1.0.3 - 1.7.0.

How to fix this

Upgrade the rails-html-sanitizer library to the patch version. As a workaround, remove SVG reference elements such as use and feImage from overridden allowed tags.