Description
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze8 | DSA-2655-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | ruby193-rubygem-actionpack +1 | 1:3.2.8-5.el6 | RHSA-2013:0698 |
| Red Hat OpenShift 1 | rubygem-actionpack | 1:3.0.13-8.el6op | RHSA-2013:0698 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | actionpack | < 2.3.18 | 2.3.18 | GHSA-j838-vfpq-fmf2 |
| RubyGems | actionpack | >= 3.0.0, < 3.1.12 | 3.1.12 | GHSA-j838-vfpq-fmf2 |
| RubyGems | actionpack | >= 3.2.0, < 3.2.13 | 3.2.13 | GHSA-j838-vfpq-fmf2 |
Advisories 2
- RHSA-2013:0698 Red Hat Security Advisory: rubygem-actionpack and ruby193-rubygem-actionpack security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2655-1 rails - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- APPLE-SA-2013-10-22-5 vendor-advisory
- openSUSE-SU-2014:0019 vendor-advisory
- openSUSE-SU-2013:0662 vendor-advisory
- http://support.apple.com/kb/HT5784
- RHSA-2013:0698 vendor-advisory
- APPLE-SA-2013-06-04-1 vendor-advisory
- openSUSE-SU-2013:0661 vendor-advisory
- [rubyonrails-security] 20130318 [CVE-2013-1857] XSS Vulnerability in the `sanitize` helper of Ruby on Rails mailing-list
- RHSA-2014:1863 vendor-advisory
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/