GHSA-cj75-f6xr-r4g7

Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Published

2026-07-21

Modified

2026-07-21

Sources

github-advisory

Summary

## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as ` `. See related [GHSA-9wjq-cp2p-hrgf](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf) in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: `>= 1.0.3, ` can load and render external SVG content by reference, and if the referenced document is same-origin and contains scripts, it could execute in the context of the sanitized document. ` ` can load external images, which can be used for tracking. Applications are impacted only when the allowed tags are overridden to include one of these SVG reference elements, for example ` ` or ` `. The default allowed tags do not include these SVG elements, so applications using the default configuration are not affected. ## Workarounds Remove the SVG reference elements (such as `use` and `feImage`) from the overridden allowed tags. Applications using the default allowed tags are not affected. ## References - [GHSA-9wjq-cp2p-hrgf: SVG `href` attribute bypasses local-reference restriction in Loofah](https://github.com/flavorjones/loofah/security/advisories/GHSA-9wjq-cp2p-hrgf) - [CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html) ## Credit Found by maintainer Mike Dalessio during a security audit.

Affected packages

Remediation: Upgrade to 1.7.1 or later.

References

• https://github.com/advisories/GHSA-cj75-f6xr-r4g7