GHSA-cj75-f6xr-r4g7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

• RubyGems rails-html-sanitizer: >= 1.0.3, < 1.7.1 → fixed in 1.7.1

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as ``. See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. • Versions affected: `>= 1.0.3, ` can load and render external SVG content by reference, and if the referenced document is same-origin and contains scripts, it could execute in the context of the sanitized document. `` can load external images, which can be used for tracking. Applications are impacted only when the allowed tags are overridden to include one of these SVG reference elements, for example `` or ``. The default allowed tags do not include these SVG elements, so applications using the default configuration are not affected. Workarounds Remove the SVG reference elements (such as `use` and `feImage`) from the overridden allowed tags. Applications using the default allowed tags are not affected. References • GHSA-9wjq-cp2p-hrgf: SVG `href` attribute bypasses local-reference restriction in Loofah • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Credit Found by maintainer Mike Dalessio during a security audit.