rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
Affected: RubyGems: rails-html-sanitizer
## Summary
There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.
- Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4
## Impact
A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways:
- allow both "math" and "style" elements, - or allow both "svg" and "style" elements
Code is only impacted if allowed tags are being overridden. Applications may be doing this in four different ways:
1. using application configuration:
```ruby # In config/application.rb config.action_view.sanitized_allowed_tags = ["math", "style"] # or config.action_view.sanitized_allowed_tags = ["svg", "style"] ```
see https://guides.rubyonrails.org/configuring.html#configuring-action-view
2. using a `:tags` option to the Action View helper `sanitize`:
``` <%= sanitize @comment.body, tags: ["math", "style"] %> <%# or %> <%= sanitize @comment.body, tags: ["svg", "style"] %> ```
see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitize
3. using Rails::Html::SafeListSanitizer class method `allowed_tags=`:
```ruby # class-level option Rails::Html::SafeListSanitizer.allowed_tags = ["math", "style"] # or Rails::Html::SafeListSanitizer.allowed_tags = ["svg", "style"] ```
4. using a `:tags` options to…
ruby3.1-rubygem-rails-html-sanitizer-1.5.0-1.1 on GA media
jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode SnakeYaml: Constructor Deserialization Remote Code Execution rubygem-actionpack: Possible cross-site scripting vulnerability in Action Pack rubygem-loofah: inefficient regular expression leading to denial of service rubygem-loofah: Improper neutralization of data URIs leading to Cross Site Scripting rubygem-loofah: Uncontrolled Recursion leading to denial of service rubygem-rails-html-sanitizer: Inefficient Regular Expression leading to denial of service rubygem-rails-html-sanitizer: Improper neutralization of data URIs leading to Cross site scripting rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations snakeyaml: Denial of Service due to missing nested depth limitation for collections tfm-rubygem-actionview: Possible cross-site scripting vulnerability in Action View tag helpers rubygem-tzinfo: arbitrary code execution activerecord: Possible RCE escalation bug with Serialized Columns in Active Record apache-commons-configuration: Apache Commons Configuration insecure interpolation defaults snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match snakeyaml: Uncaug…
Security update for rubygem-rails-html-sanitizer
Affected: Ubuntu:16.04:LTS: ruby-rails-html-sanitizer, Ubuntu:18.04:LTS: ruby-rails-html-sanitizer, Ubuntu:20.04:LTS: ruby-rails-html-sanitizer, Ubuntu:22.04:LTS: ruby-rails-html-sanitizer, Ubuntu:24.04:LTS: ruby-rails-html-sanitizer, Ubuntu:25.10: ruby-rails-html-sanitizer, Ubuntu:26.04:LTS: ruby-rails-html-sanitizer
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
Ein Angreifer kann mehrere Schwachstellen in genua genucenter ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.