HTML Sanitization Flaw in Rails HTML Sanitizer for Ruby
CVE-2026-73648

5.1MEDIUM

Key Information:

Vendor

Rails

Status
Rails-html-sanitizer
Vendor
CVE Published:
13 August 2026

What is CVE-2026-73648?

The rails-html-sanitizer, a crucial component for HTML sanitization in Ruby on Rails applications, contains a vulnerability in versions 1.0.3 through 1.7.1. This flaw allows certain SVG reference elements to bypass restrictions, permitting potential external references when non-default allowed tags include SVG usage or feImage elements. Malicious external SVGs could execute scripts within the context of the sanitized document, while feImage could facilitate the loading of external images, raising security concerns. Users are advised to upgrade to version 1.7.1, wherein this issue has been addressed.

Affected Version(s)

rails-html-sanitizer >= 1.0.3, < 1.7.1

References

https://github.com/rails/rails-html-sanitizer/security/ad...
x_refsource_CONFIRM
https://github.com/rails/rails-html-sanitizer/pull/223
x_refsource_MISC
https://github.com/rails/rails-html-sanitizer/commit/74dc...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.