Skip to content
OpenAdvisories
High DLA-3652-1 1 CVE

ruby-sanitize - security update

Published Nov 14, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 ruby-sanitize 4.6.6-2.1~deb10u2

Vulnerabilities 1

  • High 7.1
    CVE-2023-36823

    Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

    Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…

    rgrove sanitize ruby-sanitize sanitize Debian Ubuntu RubyGems