Skip to content
OpenAdvisories

Package · Debian

ruby-sanitize

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.1
    CVE-2023-36823

    Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

    Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-…

    rgrove sanitize sanitize ruby-sanitize Debian Ubuntu RubyGems
  • High 7.3
    CVE-2020-4054

    Cross-site Scripting in Sanitize

    In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math…

    rgrove sanitize ruby-sanitize sanitize Debian Ubuntu RubyGems
  • High 7.5
    CVE-2018-3740

    Sanitize vulnerable to Improper Input Validation and Cross-site Scripting

    A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

    Ryan Grove sanitize (ruby gem) ruby-sanitize sanitize Debian Ubuntu RubyGems