Description
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-rails-html-sanitizer | 1.0.3-1 | — |
| Debian 13 | ruby-rails-html-sanitizer | 1.0.3-1 | — |
| Debian 12 | ruby-rails-html-sanitizer | 1.0.3-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | portus | 2.0.3-2.4 | SUSE-SU-2016:1146-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 2.1 | rubygem-rails-html-sanitizer | 1.0.2-7.1 | SUSE-SU-2016:0391-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-rails-html-sanitizer | 1.5.0-2.1 | openSUSE-SU-2024:13137-1 |
| openSUSE Tumbleweed | rubygem-rails-html-sanitizer | 1.4.3-1.1 | openSUSE-SU-2026:10361-1, openSUSE-SU-2025:15125-1, openSUSE-SU-2024:14175-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rails-html-sanitizer | < 1.0.3 | 1.0.3 | GHSA-59c7-4xj2-hgvw |
Advisories 8
- WID-SEC-2025-1085 Ruby on Rails: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 17, 2026
- openSUSE-SU-2026:10361-1 ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2024:14175-1 ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15125-1 ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:1146-1 Security update for portus SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13137-1 ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12145-1 ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2016:0391-1 Security update for rubygem-rails-html-sanitizer SUSE / openSUSE Security Updates · Feb 4, 2026
References
- FEDORA-2016-3a2606f993 vendor-advisory
- [oss-security] 20160125 [CVE-2015-7578] Possible XSS vulnerability in rails-html-sanitizer mailing-list
- SUSE-SU-2016:1146 vendor-advisory
- https://github.com/rails/rails-html-sanitizer/commit/297161e29a3e11186ce4c02bf7defc088bf544d4
- 1034816 vdb-entry
- [ruby-security-ann] 20160125 [CVE-2015-7578] Possible XSS vulnerability in rails-html-sanitizer mailing-list
- FEDORA-2016-59ce8b61dd vendor-advisory
- SUSE-SU-2016:0391 vendor-advisory
- openSUSE-SU-2016:0356 vendor-advisory