Log in Start free

Vulnerability · Published Jun 16, 2020 · Assigned by GitHub_M

CVE-2020-4054Cross-site Scripting in Sanitize

High 7.3

In plain English

A high-severity cross-site scripting in Sanitize from rgrove. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.9%top 20.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-sanitize4.6.6-2.1DEBIAN-CVE-2020-4054
Debian:13ruby-sanitize4.6.6-2.1DEBIAN-CVE-2020-4054
Debian:14ruby-sanitize4.6.6-2.1DEBIAN-CVE-2020-4054
RubyGemssanitize5.2.1GHSA-p4x4-rw2p-8j8m

Affected products (as reported)

VendorProductVersions
rgrove Sanitize >= 3.0.0, < 5.2.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References