CVE-2026-128068

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions 1.0.3 through 1.7.1

Description Rails::HTML::PermitScrubber improperly validates SVG href and xlink:href local references using a regular expression pattern. When an application customizes allowed tags to include SVG reference elements like use and permits href or xlink:href, an attacker can provide HTML containing a long sequence of whitespace. This causes the regular expression engine to rescan the value from each line start, leading to quadratic CPU consumption. This issue affects JRuby and CRuby versions 3.1 and earlier; CRuby 3.2 and later are not affected due to linear-time regular expression matching.

Recommendations Update rails-html-sanitizer to version 1.7.2. Run Ruby 3.2 or later. Remove SVG reference elements from the overridden allowed tags.