SB2026110848 - Multiple vulnerabilities in rails-html-sanitizer

Description

This security bulletin contains information about 2 vulnerabilities.

1) Inefficient regular expression complexity (CVE-ID: N/A)

CWE-ID: CWE-1333 - Inefficient Regular Expression Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to degrade application availability through excessive CPU consumption.

The vulnerability exists due to quadratic regular expression matching in rails-html-sanitizer's SVG reference checks on JRuby or CRuby before 3.2 when custom rules allow SVG reference elements and reference attributes. An unauthenticated remote attacker can submit HTML containing an SVG reference element with a long whitespace-only href or xlink:href value to trigger disproportionate processing time.

2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows an unauthenticated remote attacker to execute JavaScript in other users' browsers when they view affected output.

The vulnerability exists due to unsynchronized shared allowlist state in rails-html-sanitizer during concurrent sanitization calls with differing options in a multithreaded process. An unauthenticated remote attacker can trigger a path permitting scripts or event handlers concurrently with a stricter call, causing malicious content to survive sanitization and reach victims.

Remediation

Install update from vendor's website.

References

• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-h7wh-q2qr-458c