GHSA-mrhj-2g4v-39qx
Moderate severity vulnerability that affects rails-html-sanitizer
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.0.3- Upgrade rails-html-sanitizer to this version or later
Description
Withdrawn, accidental duplicate publish.
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| rails-html-sanitizer | >= 1.0.2, < 1.0.3 |
1.0.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
rails-html-sanitizer RubyGems → 1.0.3
- bundler
bundle update rails-html-sanitizer # Gemfile: gem "rails-html-sanitizer", ">= 1.0.3"
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-cj75-f6xr-r4g7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-2x5m-9ch4-qgrr rails-html-sanitizer has XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-cfjx-w229-hgx5 rails-html-sanitizer has XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-638j-pmjw-jq48 rails-html-sanitizer has XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-w8gc-x259-rc7x rails-html-sanitize has XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-rxv5-gxqc-xx8g rails-html-sanitizer has XSS vulnerability with certain configurations | Medium | Also affects rails-html-sanitizer |
| GHSA-rrfc-7g8p-99q8 Possible XSS vulnerability with certain configurations of rails-html-sanitizer | Medium | Also affects rails-html-sanitizer |
| GHSA-9h9g-93gc-623h Possible XSS vulnerability with certain configurations of rails-html-sanitizer | Medium | Also affects rails-html-sanitizer |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor