Rails Html Sanitizer
Approved changes feed: RSS · Atom
cpe:2.3:a:rails:rails-html-sanitizer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Rails (c2f75d8c-3de5-5ca8-bae8-6b2589edf586) |
|---|---|
| Product | Rails Html Sanitizer (bdcb8f1d-9b42-5a66-9e9a-943a3ab2b26d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-53989 |
vulnerable | 2026-06-08 06:54:15.810254 |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the the "noscript" element. This vulnerability is fixed in 1.6.1.
Published: 2024-12-02T21:07:04.296Z
Updated: 2024-12-03T14:35:25.922Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53988 |
vulnerable | 2026-06-08 06:54:15.809875 |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.
Published: 2024-12-02T21:09:56.440Z
Updated: 2024-12-03T14:34:23.054Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53987 |
vulnerable | 2026-06-08 06:54:15.809298 |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.
Published: 2024-12-02T21:15:48.975Z
Updated: 2024-12-03T14:33:22.284Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53986 |
vulnerable | 2026-06-08 06:54:15.808896 |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.
Published: 2024-12-02T21:13:01.441Z
Updated: 2024-12-03T14:33:51.139Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53985 |
vulnerable | 2026-06-08 06:54:15.807232 |
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.
Published: 2024-12-02T21:15:57.620Z
Updated: 2024-12-11T16:47:59.133Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23520 |
vulnerable | 2026-06-08 05:40:57.683280 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23519 |
vulnerable | 2026-06-08 05:40:57.682898 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23518 |
vulnerable | 2026-06-08 05:40:57.682398 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-23517 |
vulnerable | 2026-06-08 05:40:57.681322 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-3741 |
vulnerable | 2026-06-08 05:11:41.208173 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.