Cross-site scripting in rails-html-sanitizer - #VU161895
Published: November 8, 2026
Vulnerability identifier: #VU161895
CSH Severity: Medium
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute JavaScript in other users' browsers when they view affected output.
The vulnerability exists due to unsynchronized shared allowlist state in rails-html-sanitizer during concurrent sanitization calls with differing options in a multithreaded process. An unauthenticated remote attacker can trigger a path permitting scripts or event handlers concurrently with a stricter call, causing malicious content to survive sanitization and reach victims.
Affected software
rails-html-sanitizer
Remediation
Install security update from vendor's website.
rails-html-sanitizer - update to 1.7.2