SB2026110616 - Multiple vulnerabilities in sanitize

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an unauthenticated remote attacker to inject arbitrary HTML and execute JavaScript in the context of a site displaying sanitized content.

The vulnerability exists due to namespace confusion in Sanitize when removing a MathML or SVG ancestor while retaining allowed foreign elements that browsers subsequently reinterpret as HTML, triggered by configurations whose remove_contents setting is false or omits at least one of math and svg, and that allow either a text-content element such as <textarea>, <title>, <xmp>, <noembed>, or <noframes> with exploitable attributes, comments, or nested raw text, or <select> together with a raw-text element. An unauthenticated remote attacker can submit crafted HTML containing either a MathML or SVG ancestor, neither of which needs to be allowlisted, and bypass sanitization through four distinct mechanisms: placing a closing tag and malicious markup in an allowed attribute on an allowed descendant that does not exit foreign content when Nokogiri's HTML5 serializer leaves angle brackets unescaped; placing the same payload in a verbatim-serialized comment when allow_comments is true; placing a closing tag and malicious markup in an allowed <xmp>, <noembed>, <noframes>, or <plaintext> element beneath an HTML integration point inside a foreign text-content element, causing verbatim HTML5 serialization to preserve a closing tag that terminates the outer element when reparsed; or placing an allowed raw-text element beneath an integration point inside a foreign <select>, causing browsers with legacy select parsing rules to ignore the raw-text start tag and interpret its contents as markup, whereas browsers using newer select parsing rules are unaffected by this last case; integration points need not be allowlisted, all four mechanisms permit deeper nesting within allowed elements that preserve foreign content, and the attribute and raw-text mechanisms depend on HTML5 serialization behavior absent from the escaping libxml2 serializer.

2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute JavaScript in a victim's browser when the victim views sanitized HTML.

The vulnerability exists due to inconsistent parsing after Sanitize removes template wrappers under non-default configurations allowing select and raw text elements while preserving template contents. An unauthenticated remote attacker can submit crafted HTML that bypasses sanitization and executes scripts when rendered by a victim's browser using legacy select parsing rules.

Remediation

Install update from vendor's website.

References

• https://github.com/rgrove/sanitize/security/advisories/GHSA-599p-54q3-ff89
• https://github.com/rgrove/sanitize/security/advisories/GHSA-mg79-gw37-jxx7