CVE catalog

CVE-2015-7578

ruby-rails-html-sanitizer: CVE-2015-7578

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.48% · Oct 25, 2026

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-rails-html-sanitizersid1.7.1-1fixed
Debianruby-rails-html-sanitizerforky1.7.1-1fixed
Debianruby-rails-html-sanitizertrixie1.6.2-1fixed
Debianruby-rails-html-sanitizerbookworm1.4.4-1fixed
Opensuserubygem-rails-html-sanitizertumbleweed1.6.0-1.9fixed
Opensuserubygem-rails-html-sanitizertumbleweed1.6.0-1.5fixed
Opensuserubygem-rails-html-sanitizertumbleweed1.6.0-1.7fixed
Opensuseruby3.2-rubygem-rails-html-sanitizertumbleweed1.5.0-2.1fixed
Opensuserubygem-rails-html-sanitizertumbleweed1.4.3-1.1fixed
Suserubygem-rails-html-sanitizerenterprise storage 2.11.0.2-7.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-rails-html-sanitizersourcesid1.0.3-1not yet assignedNot reported[812814]
Debianruby-rails-html-sanitizersourceforky1.0.3-1not yet assignedNot reported[812814]
Debianruby-rails-html-sanitizersourcetrixie1.0.3-1not yet assignedNot reported[812814]
Debianruby-rails-html-sanitizersourcebookworm1.0.3-1not yet assignedNot reported[812814]
Opensuserubygem-rails-html-sanitizerrpmtumbleweed1.6.0-1.9Not reportedOPENSUSE-SU-2026:10361-1Not reported
Opensuserubygem-rails-html-sanitizerrpmtumbleweed1.6.0-1.5Not reportedOPENSUSE-SU-2024:14175-1Not reported
Opensuserubygem-rails-html-sanitizerrpmtumbleweed1.6.0-1.7Not reportedOPENSUSE-SU-2025:15125-1Not reported
Opensuseruby3.2-rubygem-rails-html-sanitizerrpmtumbleweed1.5.0-2.1Not reportedOPENSUSE-SU-2024:13137-1Not reported
Opensuserubygem-rails-html-sanitizerrpmtumbleweed1.4.3-1.1Not reportedOPENSUSE-SU-2024:12145-1Not reported
Suserubygem-rails-html-sanitizerrpmenterprise storage 2.11.0.2-7.1Not reportedSUSE-SU-2016:0391-1Not reported

[Debian bug #812814]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[Debian 12 (Bookworm)]

  • [ruby-rails-html-sanitizer]Fixed
    Details (2)

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.0.3-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm; dsa · ruby-rails-html-sanitizer · debian · 12

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.0.3-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm; dsa · ruby-rails-html-sanitizer · debian · 12

[Debian 13 (Trixie)]

  • [ruby-rails-html-sanitizer]Fixed
    Details (2)

    • 1.6.2-1 · all · trixie

      Fixed · Fixed: 1.0.3-1

      dsa · ruby-rails-html-sanitizer · debian · 13

    • 1.6.2-1 · all · trixie

      Fixed · Fixed: 1.0.3-1

      dsa · ruby-rails-html-sanitizer · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]