Vulnerability · Published Aug 13, 2026 · Assigned by GitHub_M
CVE-2026-73648rails-html-sanitizer: Possible XSS vulnerability with certain configurations
Medium 5.1
In plain English
A medium-severity cross-site scripting in rails-html-sanitizer from rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-rails-html-sanitizer | no fix listed | DEBIAN-CVE-2026-73648 |
| Debian:13 | ruby-rails-html-sanitizer | no fix listed | DEBIAN-CVE-2026-73648 |
| Debian:14 | ruby-rails-html-sanitizer | 1.7.1-1 | DEBIAN-CVE-2026-73648 |
| RubyGems | rails-html-sanitizer | 1.7.1 | GHSA-cj75-f6xr-r4g7 |
| Ubuntu:22.04:LTS | ruby-rails-html-sanitizer | no fix listed | UBUNTU-CVE-2026-73648 |
| Ubuntu:24.04:LTS | ruby-rails-html-sanitizer | no fix listed | UBUNTU-CVE-2026-73648 |
| Ubuntu:26.04:LTS | ruby-rails-html-sanitizer | no fix listed | UBUNTU-CVE-2026-73648 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rails | rails-html-sanitizer | >= 1.0.3, < 1.7.1 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7 x_refsource_CONFIRM
- https://github.com/rails/rails-html-sanitizer/pull/223 x_refsource_MISC
- https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586 x_refsource_MISC
- https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1 x_refsource_MISC