Cross-site scripting in rails-html-sanitizer - CVE-2026-73648
Published: November 8, 2026
Vulnerability identifier: #VU161893
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-73648
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to execute scripts in a victim's browser in the context of a sanitized document.
The vulnerability exists due to rails-html-sanitizer restricting SVG references through xlink:href but not plain href when applications override allowed tags to include use. An unauthenticated attacker can supply a use element referencing a same-origin SVG document containing scripts, which may execute when a victim views the sanitized content.
Affected software
rails-html-sanitizer
How to mitigate CVE-2026-73648
Install security update from vendor's website.
rails-html-sanitizer - update to 1.7.1