PT-2026-71724
CVE-2026-73648
·
Published
2026-07-21
·
Updated
2026-11-06
Description by
CVSS 4.0
5.1
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
rails-html-sanitizer versions 1.0.3 through 1.7.0
Description
The
Rails::HTML::PermitScrubber component fails to properly restrict SVG reference elements when SVG ALLOW LOCAL HREF is used. While the scrubber restricts the xlink:href attribute, it ignores the plain href attribute, which is also accepted by browsers. In applications using non-default allowed tags that include use or feImage elements, this allows external references. A same-origin external SVG referenced by use can execute scripts within the context of the sanitized document, and feImage can be used to load external images for tracking purposes. Applications utilizing default allowed tags are not impacted.Recommendations
Update to version 1.7.1.
Found an issue in the description? Have something to add? Feel free to write us 👾