PT-2026-71724 · Rubygems · Rails-Html-Sanitizer
CVE-2026-73648
·
Published
2026-07-21
·
Updated
2026-08-13
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
rails-html-sanitizer versions 1.0.3 through 1.7.0
Description
The
Rails::HTML::PermitScrubber component fails to properly restrict SVG reference elements when SVG ALLOW LOCAL HREF is used. While the scrubber restricts the xlink:href attribute, it ignores the plain href attribute, which is also accepted by browsers. In applications using non-default allowed tags that include use or feImage elements, this allows external references. A same-origin external SVG referenced by use can execute scripts within the context of the sanitized document, and feImage can be used to load external images for tracking purposes. Applications utilizing default allowed tags are not impacted.Recommendations
Update to version 1.7.1.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rails-Html-Sanitizer