CVE-2022-23517

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions < 1.4.4

Description The issue is related to certain configurations of rails-html-sanitizer that use an inefficient regular expression. This inefficiency can lead to excessive backtracking when attempting to sanitize certain SVG attributes, resulting in a denial of service through CPU resource consumption. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations Upgrade to rails-html-sanitizer version 1.4.4 or later.