Cross-Site Scripting Vulnerability in Rails::Html::Sanitizer for Ruby on Rails

CVE-2022-32209

What is CVE-2022-32209?

A Cross-Site Scripting (XSS) vulnerability exists in Rails::Html::Sanitizer that can be exploited when certain configurations allow the inclusion of 'select' and 'style' tags. If an application developer overrides the default settings to permit these tags, attackers may inject malicious content that could compromise user data and integrity. It is crucial for users who have customized the allowed tags for sanitization through any means—such as application configuration or the sanitize helper—to either promptly upgrade to the fixed version or apply workarounds by removing 'select' or 'style' from their configurations.

References