CVE catalog

CVE-2022-23518

ruby-rails-html-sanitizer: CVE-2022-23518

[CVE catalog]

Severity
High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-rails-html-sanitizersid1.7.1-1fixed
Debianruby-rails-html-sanitizerforky1.7.1-1fixed
Debianruby-rails-html-sanitizertrixie1.6.2-1fixed
Debianruby-rails-html-sanitizerbookworm1.4.4-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-rails-html-sanitizersourcesid1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourceforky1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourcetrixie1.4.4-1not yet assignedNot reported[1027153]
Debianruby-rails-html-sanitizersourcebookworm1.4.4-1not yet assignedNot reported[1027153]

[Debian bug #1027153]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-rails-html-sanitizer]Fixed
    Details (2)

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm

    • 1.4.4-1 · all · bookworm

      Fixed · Fixed: 1.4.4-1

      dsa · ruby-rails-html-sanitizer · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]