logo

Database

Reflected cross-site scripting (XSS) In ruby-rails-html-sanitizer

Description

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-235182. NVD-2022-235183. OSV-DEBIAN-2022-235184. OSV-2022-235185. GHSA-mcvf-2q2m-x72m6. GCVE-2022-235187. SECURITY-TRACKER-CVE-2022-235188. GHSA-mcvf-2q2m-x72m9. lists.debian.org10. lists.debian.org

References

1. https://hackerone.com/reports/16941732. https://github.com/rails/rails-html-sanitizer/issues/1353. https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m4. https://github.com/w3c/svgwg/issues/2665. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-23518.yml

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.