CVE catalog

CVE-2023-23627

ruby-sanitize: CVE-2023-23627

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.53% · Oct 27, 2026

Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-sanitizesid7.0.0-1fixed
Debianruby-sanitizeforky7.0.0-1fixed
Debianruby-sanitizetrixie7.0.0-1fixed
Debianruby-sanitizebookworm6.0.0-1.1+deb12u1fixed
Debianruby-sanitizebookworm-security6.0.0-1.1+deb12u1fixed
Ubunturuby-sanitize20.044.6.6-2vulnerable
Ubunturuby-sanitize20.044.6.6-2.1~0.20.04.1vulnerable
Ubunturuby-sanitize20.044.6.6-2.1~0.20.04.2fixed
Ubunturuby-sanitize22.045.2.1-2vulnerable
Ubunturuby-sanitize22.045.2.3-1vulnerable
Ubunturuby-sanitize22.046.0.0-1vulnerable
Ubunturuby-sanitize22.046.0.0-1ubuntu0.1fixed
Ubunturuby-sanitize20.044.6.6-2vulnerable
Ubunturuby-sanitize20.044.6.6-2.1~0.20.04.1vulnerable
Ubunturuby-sanitize20.044.6.6-2.1~0.20.04.2fixed
Ubunturuby-sanitize22.045.2.1-2vulnerable
Ubunturuby-sanitize22.045.2.3-1vulnerable
Ubunturuby-sanitize22.046.0.0-1vulnerable
Ubunturuby-sanitize22.046.0.0-1ubuntu0.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-sanitizesourcesid6.0.0-1.1not yet assignedNot reported[1030047]
Debianruby-sanitizesourceforky6.0.0-1.1not yet assignedNot reported[1030047]
Debianruby-sanitizesourcetrixie6.0.0-1.1not yet assignedNot reported[1030047]
Debianruby-sanitizesourcebookworm6.0.0-1.1not yet assignedNot reported[1030047]
Ubunturuby-sanitizedeb20.044.6.6-2.1~0.20.04.2Not reportedUSN-6748-1Not reported
Ubunturuby-sanitizedeb22.046.0.0-1ubuntu0.1Not reportedUSN-6748-1Not reported
Ubunturuby-sanitizedeb20.044.6.6-2.1~0.20.04.2Not reportedUBUNTU-CVE-2023-23627Not reported
Ubunturuby-sanitizedeb22.046.0.0-1ubuntu0.1Not reportedUBUNTU-CVE-2023-23627Not reported

[Debian bug #1030047]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ruby-sanitize]Fixed
    Details (4)

    • 6.0.0-1.1+deb12u1 · all · bookworm

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · bookworm; dsa · ruby-sanitize · debian · 12

    • 6.0.0-1.1+deb12u1 · all · bookworm

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · bookworm; dsa · ruby-sanitize · debian · 12

    • 6.0.0-1.1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · bookworm; dsa · ruby-sanitize · debian · 12

    • 6.0.0-1.1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · bookworm; dsa · ruby-sanitize · debian · 12

[Debian 13 (Trixie)]

  • [ruby-sanitize]Fixed
    Details (2)

    • 7.0.0-1 · all · trixie

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · 13

    • 7.0.0-1 · all · trixie

      Fixed · Fixed: 6.0.0-1.1

      dsa · ruby-sanitize · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]