HTML Sanitization Vulnerability in Rails::HTML::PermitScrubber by Rails
CVE-2026-128068

5.3MEDIUM

Key Information:

Vendor

Rails

Status
Rails-html-sanitizer
Vendor
CVE Published:
13 November 2026

What is CVE-2026-128068?

A vulnerability has been identified in Rails::HTML::PermitScrubber, which is essential for sanitizing HTML fragments in Rails applications. This issue affects versions 1.0.3 to 1.7.1, where improper checks on SVG href and xlink:href references can lead to inefficient processing, causing significant CPU resource consumption if an attacker injects malicious HTML. It is relevant to applications that customize allowed tags to include SVG elements. The default configuration is safe and unaffected. The issue has been resolved in version 1.7.2, which ensures optimized regular expression matching, mitigating the risks associated with this vulnerability.

Affected Version(s)

rails-html-sanitizer >= 1.0.3, < 1.7.2

References

https://github.com/rails/rails-html-sanitizer/security/ad...
x_refsource_CONFIRM
https://github.com/rails/rails-html-sanitizer/commit/f776...
x_refsource_MISC
https://github.com/rails/rails-html-sanitizer/releases/ta...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.