CVE-2026-73648

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73648", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-13T14:04:09.604Z", "datePublished": "2026-08-13T18:00:21.583Z", "dateUpdated": "2026-08-13T18:35:10.270Z"}, "containers": {"cna": {"title": "rails-html-sanitizer: Possible XSS vulnerability with certain configurations", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7"}, {"name": "https://github.com/rails/rails-html-sanitizer/pull/223", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails-html-sanitizer/pull/223"}, {"name": "https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586"}, {"name": "https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1"}], "affected": [{"vendor": "rails", "product": "rails-html-sanitizer", "versions": [{"version": ">= 1.0.3, < 1.7.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T18:00:21.583Z"}, "descriptions": [{"lang": "en", "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1."}], "source": {"advisory": "GHSA-cj75-f6xr-r4g7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-13T18:34:06.330753Z", "id": "CVE-2026-73648", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T18:35:10.270Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73648", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-13T18:34:06.330753Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-13T18:34:22.614Z"}}], "cna": {"title": "rails-html-sanitizer: Possible XSS vulnerability with certain configurations", "source": {"advisory": "GHSA-cj75-f6xr-r4g7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "rails", "product": "rails-html-sanitizer", "versions": [{"status": "affected", "version": ">= 1.0.3, < 1.7.1"}]}], "references": [{"url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7", "name": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rails/rails-html-sanitizer/pull/223", "name": "https://github.com/rails/rails-html-sanitizer/pull/223", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586", "name": "https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1", "name": "https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-13T18:00:21.583Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73648", "state": "PUBLISHED", "dateUpdated": "2026-08-13T18:35:10.270Z", "dateReserved": "2026-08-13T14:04:09.604Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-13T18:00:21.583Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rails-html-sanitizer", "vendor": "rails", "versions": [{"status": "affected", "version": ">= 1.0.3, < 1.7.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1."}, {"lang": "es", "value": "rails-html-sanitizer es responsable de sanitizar fragmentos HTML en aplicaciones Rails. Desde la 1.0.3 hasta la 1.7.1, Rails::HTML::PermitScrubber restring\u00eda los elementos de referencia SVG en SVG_ALLOW_LOCAL_HREF solo cuando usaban xlink:href, a pesar de que los navegadores tambi\u00e9n aceptan el atributo href simple. Las aplicaciones con etiquetas permitidas no predeterminadas que inclu\u00edan elementos SVG use o feImage pod\u00edan, por lo tanto, permitir referencias externas; un SVG externo del mismo origen referenciado por use podr\u00eda ejecutar scripts en el contexto del documento sanitizado, mientras que feImage pod\u00eda cargar im\u00e1genes externas para seguimiento. Las aplicaciones que usan las etiquetas permitidas predeterminadas no se ven afectadas. Este problema est\u00e1 solucionado en la versi\u00f3n 1.7.1."}], "id": "CVE-2026-73648", "lastModified": "2026-10-24T15:10:00.190", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73648", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-13T18:34:06.330753Z", "version": "2.0.3"}}]}, "published": "2026-08-13T18:18:20.620", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails-html-sanitizer/pull/223"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization", "id": "2515530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515530"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.", "A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by exploiting improper sanitization of SVG (Scalable Vector Graphics) reference elements. The Rails::HTML::PermitScrubber component failed to restrict the href attribute in SVG elements, which browsers accept in addition to xlink:href. This oversight could enable an attacker to execute malicious scripts in the context of the sanitized document or load external images for tracking, affecting applications configured with non-default allowed SVG tags."], "name": "CVE-2026-73648", "public_date": "2026-08-13T18:00:21Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-73648\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-73648\nhttps://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586\nhttps://github.com/rails/rails-html-sanitizer/pull/223\nhttps://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1\nhttps://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.3,1.7.1)"}}], "enrichment": {"confidence": 88.0, "confidence_source": "matching", "scores": [{"score": 88.0, "source": "matching"}]}, "original": {"product": "rails-html-sanitizer", "source": "cna", "vendor": "rails"}, "product": "rails_html_sanitizers", "vendor": "rubyonrails"}], "created": "2026-08-13T19:45:17.313685+00:00", "updated": "2026-08-14T10:00:03.907396+00:00", "vendors": ["rubyonrails", "rubyonrails$PRODUCT$rails_html_sanitizers"]}