CVE catalog
CVE-2026-73648
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF o
- Severity
- Medium · CVSS 6.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.55% · Oct 25, 2026
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | ruby-rails-html-sanitizer | sid | 1.7.1-1 | fixed |
| Debian | ruby-rails-html-sanitizer | forky | 1.7.1-1 | fixed |
| Debian | ruby-rails-html-sanitizer | trixie | 1.6.2-1 | vulnerable |
| Debian | ruby-rails-html-sanitizer | bookworm | 1.4.4-1 | vulnerable |
| Rubygems | rails-html-sanitizer | Not reported | 1.7.1 | fixed |
| Suse | rubygem-rails-html-sanitizer | linux enterprise high availability extension 15 sp4 | 1.0.4-150000.4.9.1 | fixed |
| Suse | rubygem-rails-html-sanitizer | linux enterprise high availability extension 15 sp5 | 1.0.4-150000.4.9.1 | fixed |
| Suse | rubygem-rails-html-sanitizer | linux enterprise high availability extension 15 sp6 | 1.0.4-150000.4.9.1 | fixed |
| Suse | rubygem-rails-html-sanitizer | linux enterprise high availability extension 15 sp7 | 1.0.4-150000.4.9.1 | fixed |
| Ubuntu | ruby-rails-html-sanitizer | 16.04 | 1.0.2-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 16.04 | 1.0.3-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 16.04 | 1.0.3-2 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 18.04 | 1.0.3-2 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 18.04 | 1.0.4-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 20.04 | 1.0.4-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 20.04 | 1.3.0-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 22.04 | 1.3.0-2 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 22.04 | 1.4.2-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 22.04 | 1.4.2-2 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 24.04 | 1.4.4-1 | vulnerable |
| Ubuntu | ruby-rails-html-sanitizer | 26.04 | 1.6.2-1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | ruby-rails-html-sanitizer | source | sid | 1.7.1-1 | not yet assigned | Not reported | Not reported |
| Debian | ruby-rails-html-sanitizer | source | forky | 1.7.1-1 | not yet assigned | Not reported | Not reported |
| Debian | ruby-rails-html-sanitizer | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | ruby-rails-html-sanitizer | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Rubygems | rails-html-sanitizer | rubygems | Not reported | 1.7.1 | Not reported | GHSA-CJ75-F6XR-R4G7 | Not reported |
| Suse | rubygem-rails-html-sanitizer | rpm | linux enterprise high availability extension 15 sp4 | 1.0.4-150000.4.9.1 | Not reported | SUSE-SU-2026:4445-1 | Not reported |
| Suse | rubygem-rails-html-sanitizer | rpm | linux enterprise high availability extension 15 sp5 | 1.0.4-150000.4.9.1 | Not reported | SUSE-SU-2026:4445-1 | Not reported |
| Suse | rubygem-rails-html-sanitizer | rpm | linux enterprise high availability extension 15 sp6 | 1.0.4-150000.4.9.1 | Not reported | SUSE-SU-2026:4445-1 | Not reported |
| Suse | rubygem-rails-html-sanitizer | rpm | linux enterprise high availability extension 15 sp7 | 1.0.4-150000.4.9.1 | Not reported | SUSE-SU-2026:4445-1 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [ruby-rails-html-sanitizer]Affected
Details (2)
1.4.4-1· all · bookwormAffected
nvd · ruby-rails-html-sanitizer · debian · bookworm; nvd · ruby-rails-html-sanitizer · debian · 12
1.4.4-1· all · bookwormAffected
nvd · ruby-rails-html-sanitizer · debian · bookworm; nvd · ruby-rails-html-sanitizer · debian · 12
[Debian 13 (Trixie)]
- [ruby-rails-html-sanitizer]Affected
Details (2)
1.6.2-1· all · trixieAffected
nvd · ruby-rails-html-sanitizer · debian · 13
1.6.2-1· all · trixieAffected
nvd · ruby-rails-html-sanitizer · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_4445-1.json]
- [https://github.com/advisories/GHSA-cj75-f6xr-r4g7]
- [https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586]
- [https://github.com/rails/rails-html-sanitizer/pull/223]
- [https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.1]
- [https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-73648]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-73648]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4445-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-73648]
- [https://security-tracker.debian.org/tracker/CVE-2026-73648]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-73648.json]
[Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]