GHSA-cj75-f6xr-r4g7

Medium

Published: —Translated: 27/07/2026(UTC)NVD NIST

Summary

There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as <use>. This is related to GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors.

Risk Assessment

An attacker can inject malicious JavaScript code via the SVG <use> element, leading to XSS attacks on application users.

Recommendation

Update the rails-html-sanitizer gem to a version that includes a fix restricting attributes in SVG reference elements.

Original NVD description (English source)

## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as <use>. See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors.