Skip to content
OpenAdvisories
High DSA-5616-1 1 CVE

ruby-sanitize - security update

Published Feb 5, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 11 ruby-sanitize 5.2.1-2+deb11u1
Debian · 12 ruby-sanitize 6.0.0-1.1+deb12u1

Vulnerabilities 1

  • High 7.1
    CVE-2023-36823

    Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

    Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…

    rgrove sanitize ruby-sanitize sanitize Debian Ubuntu RubyGems