rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.
CVSS Details
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-clampUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-loggingUpgrade rubygem-oauthUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debuginfoUpgrade rubygem-jwtUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade foreman-cliUpgrade rubygem-little-pluggerUpgrade satellite-maintainUpgrade rubygem-unicode-debugsourceUpgrade rubygem-rest-clientUpgrade rubygem-mime-types-dataUpgrade rubygem-unfUpgrade rubygem-ffi-debugsourceUpgrade rubygem-localeUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-unicodeUpgrade rubygem-highlineUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cliUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-gssapiUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unf_extUpgrade rubygem-multi_jsonUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unicode-display_widthUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-foreman_maintainUpgrade satellite-cloneUpgrade rubygem-apipie-bindingsUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-domain_nameUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-ffiUpgrade satellite-cliUpgrade rubygem-version_gemUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-powerbarUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foreman_google | May 4, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade ruby-rails-html-sanitizer | Sep 15, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade satellite-maintainUpgrade rubygem-multi_jsonUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-foreman_maintainUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-ffiUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-unfUpgrade rubygem-mime-typesUpgrade rubygem-unicode-display_widthUpgrade rubygem-oauth-ttyUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-http-cookieUpgrade rubygem-oauthUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-ffi-debuginfoUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-localeUpgrade rubygem-jwtUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-amazing_printUpgrade python39-pulp_manifestUpgrade rubygem-http-acceptUpgrade rubygem-snaky_hashUpgrade rubygem-fast_gettextUpgrade rubygem-gssapiUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-powerbarUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unf_extUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-highlineUpgrade satellite-cloneUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-loggingUpgrade rubygem-ffi-debugsource | May 4, 2023 | Dec 14, 2022 |
| Rocky_linux | — | Upgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-debuginfo | Mar 12, 2024 | Dec 14, 2022 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Feb 7, 2024 | Dec 14, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-rails-html-sanitizerUpgrade ruby2.5-rubygem-rails-html-sanitizer-docUpgrade ruby2.5-rubygem-rails-html-sanitizer-testsuite | Sep 21, 2023 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub