Cross-site scripting in sanitize - #VU159535
Published: November 6, 2026
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to inject arbitrary HTML and execute JavaScript in the context of a site displaying sanitized content.
The vulnerability exists due to namespace confusion in Sanitize when removing a MathML or SVG ancestor while retaining allowed foreign elements that browsers subsequently reinterpret as HTML, triggered by configurations whose remove_contents setting is false or omits at least one of math and svg, and that allow either a text-content element such as <textarea>, <title>, <xmp>, <noembed>, or <noframes> with exploitable attributes, comments, or nested raw text, or <select> together with a raw-text element. An unauthenticated remote attacker can submit crafted HTML containing either a MathML or SVG ancestor, neither of which needs to be allowlisted, and bypass sanitization through four distinct mechanisms: placing a closing tag and malicious markup in an allowed attribute on an allowed descendant that does not exit foreign content when Nokogiri's HTML5 serializer leaves angle brackets unescaped; placing the same payload in a verbatim-serialized comment when allow_comments is true; placing a closing tag and malicious markup in an allowed <xmp>, <noembed>, <noframes>, or <plaintext> element beneath an HTML integration point inside a foreign text-content element, causing verbatim HTML5 serialization to preserve a closing tag that terminates the outer element when reparsed; or placing an allowed raw-text element beneath an integration point inside a foreign <select>, causing browsers with legacy select parsing rules to ignore the raw-text start tag and interpret its contents as markup, whereas browsers using newer select parsing rules are unaffected by this last case; integration points need not be allowlisted, all four mechanisms permit deeper nesting within allowed elements that preserve foreign content, and the attribute and raw-text mechanisms depend on HTML5 serialization behavior absent from the escaping libxml2 serializer.