Skip to content
OpenAdvisories
High USN-4543-1 1 CVE

ruby-sanitize vulnerability

Published Sep 25, 2020 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Michał Bentkowski discovered that Sanitize did not properly sanitize some
math or svg HTML under certain circumstances. A remote attacker could
potentially exploit this to conduct cross-site scripting (XSS) attacks.
(CVE-2020-4054)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby-sanitize 4.6.6-2.1~0.20.04.1

Vulnerabilities 1

  • High 7.3
    CVE-2020-4054

    Cross-site Scripting in Sanitize

    In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math…

    rgrove sanitize ruby-sanitize sanitize Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2020-4054