CVE-2026-73648
published 2026-08-13CVE-2026-73648: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG…
PriorityP428medium5.1CVSS 4.0
AVNACLATNPRNUIAVCNVINVANSCLSILSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.55%
45.1th percentile
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rails | rails-html-sanitizer | — | — |
CVSS provenance
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
vendor_redhat·2026-08-13·CVSS 5.1
CVE-2026-73648 [MEDIUM] CWE-79 rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
A flaw w
VulDB
rails rails-html-sanitizer up to 1.7.0 PermitScrubber cross-domain policy
vuldb·2026-09-19·CVSS 5.1
CVE-2026-73648 [MEDIUM] rails rails-html-sanitizer up to 1.7.0 PermitScrubber cross-domain policy
A vulnerability labeled as problematic has been found in rails rails-html-sanitizer up to 1.7.0. Affected by this issue is some unknown functionality of the component PermitScrubber. The manipulation results in permissive cross-domain policy with untrusted domains.
This vulnerability is reported as CVE-2026-73648. The attack can be launched remotely. No exploit exists.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73648 rubygem-rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization [fedora-all]
bugzilla·2026-08-21·CVSS 5.1
CVE-2026-73648 [MEDIUM] CVE-2026-73648 rubygem-rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization [fedora-all]
CVE-2026-73648 rubygem-rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-
Bugzilla
CVE-2026-73648 rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
bugzilla·2026-08-13·CVSS 5.1
CVE-2026-73648 [MEDIUM] CVE-2026-73648 rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
CVE-2026-73648 rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1
2026-08-13
Published