CVE-2026-73648: rails rails-html-sanitizer Cross-site Scripting
CVSS: 5.1v4.0MediumAwaiting analysis
AliasesSUSE-SU-2026:4445-1UBUNTU-CVE-2026-73648DEBIAN-CVE-2026-73648CGA-5fcc-w849-j7cjCGA-g6p5-x9m3-j9pvCGA-jcxm-wx2f-5686CGA-jxp5-fff7-wvrvCGA-rrwf-2fm4-f93cCGA-w769-mmj9-38w2CGA-2789-68vv-672vCGA-2hqw-vqgg-jvwcCGA-2j7p-p9rv-72h3CGA-33r9-mjrh-cmpvCGA-39g4-c28g-xm52CGA-3ccw-5r2w-6c2qCGA-3f4g-vqhr-r639CGA-3fgm-hfx9-54rqCGA-3h3w-qxcr-x6mwCGA-3hcj-x8r5-79gqCGA-3vfx-5q3r-78hwCGA-3xr6-8cpf-g9xpCGA-49f8-84mx-x9gpCGA-4pv7-4j5r-5mh4CGA-52hj-477w-fg86CGA-568q-5hmr-733rCGA-59c3-qc6q-c6x8CGA-5gwf-rwg6-h2x6CGA-5qp4-pggj-8cchCGA-5vf2-8wfg-7w7wCGA-63x2-w663-6f5hCGA-6cpg-qf24-xj9mCGA-6pfv-4q7q-4hhpCGA-72rm-q7v5-82xmCGA-7678-vcp2-8rvrCGA-88c7-hr68-8pp8CGA-8h6g-mwv4-3m2cCGA-8x29-7xw5-7545CGA-99wq-5p9j-x2xpCGA-9f43-7g59-v9hmCGA-9xm3-89vv-98mwCGA-c4jp-692r-9wggCGA-cwp2-42cm-px9qCGA-f4mg-vjv9-8j4cCGA-f9f4-jx4h-rqf5CGA-fc76-4667-grjhCGA-frwj-cvqh-hv9hCGA-g82h-cxx9-9324CGA-ggvr-7rmc-vc8mCGA-gjqg-32jg-m9rvCGA-gpj5-rqwr-v33pCGA-gwgh-c99r-69xcCGA-h25j-v3vw-3v9fCGA-h2gg-xp43-245mCGA-h4xg-7q7p-3q25CGA-h5hf-32h7-c2m2CGA-h83p-vc44-gpp2CGA-hfrq-8x93-v53pCGA-j4wg-wxxq-9xc4CGA-m8h3-4phg-q482CGA-mr77-47fh-6wxfCGA-mr7w-g4p6-m547CGA-mrhf-g7cr-w829CGA-pc26-vfv3-f6cvCGA-pgvj-g6mv-8fwgCGA-pjhq-6668-x2fhGHSA-cj75-f6xr-r4g7CGA-q72m-2v42-m8v4CGA-qc2w-w9xh-vv8rCGA-r2q8-525x-hr43CGA-rfch-pqrx-hp8qCGA-rw7q-99r4-387xCGA-vx9g-4mrx-425rCGA-w9pw-4486-qc8wCGA-wc34-xj97-qc8mCGA-ww69-479f-cx9mCGA-x2qf-cqpf-rwq5CGA-x35r-hx3p-j426CGA-xp4g-34j4-hmcw
Published 13-08-2026Last modified 13-08-2026
Vulnerability summary
CVE-2026-73648 is a medium (CVSS 5.1) Cross-site Scripting vulnerability in rails rails-html-sanitizer. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities.
CVSS score
5.1/10
010
Medium · v4.0 (CVE.org)EPSS score
0.55%
0%100%
Low · +0.15 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 13-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 5.1Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · DebianEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · ChainguardEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- OSV · RubygemsEcosystem advisory · calculated5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
- NVDNIST5.1MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.15 pp
From 0.40% on 20-09-2026
20-09-202620-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard37 products
- commercial-gitlab-rails-ee-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-19.2< 19.2.7-r4
- commercial-gitlab-rails-ee-fips-19.1All versions (No fix recorded)
- commercial-gitlab-rails-ee-fips-19.2< 19.2.7-r4
- gitlab-rails-ce-18.1All versions (No fix recorded)
Suse4 products
- rubygem-rails-html-sanitizer&distro=SUSE Linux Enterprise High Availability Extension 15 SP4< 1.0.4-150000.4.9.1
- rubygem-rails-html-sanitizer&distro=SUSE Linux Enterprise High Availability Extension 15 SP5< 1.0.4-150000.4.9.1
- rubygem-rails-html-sanitizer&distro=SUSE Linux Enterprise High Availability Extension 15 SP6< 1.0.4-150000.4.9.1
- rubygem-rails-html-sanitizer&distro=SUSE Linux Enterprise High Availability Extension 15 SP7< 1.0.4-150000.4.9.1
Wolfi3 products
- ruby3.2-rails-8.1< 8.1.3-r9
- ruby3.4-rails-8.1< 8.1.3-r11
- ruby4.0-rails-8.1< 8.1.3-r10
Debian1 product
- ruby-rails-html-sanitizerAll versions (No fix recorded) | < 1.7.1-1
Rails1 product
- rails-html-sanitizer≥ 1.0.3, < 1.7.1
RubyGems1 product
- rails-html-sanitizer≥ 1.0.3, < 1.7.1
Ubuntu1 product
- ruby-rails-html-sanitizerAll versions (No fix recorded)
7 vendors · 48 products
References
13 links- github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7X Refsource CONFIRMREPORTAdvisoryWEB
- github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586X Refsource MISCFIXWEB
