Read the docs
TI-2015-06302 Aliases CVE-2015-7578GHSA-59c7-4xj2-hgvw

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.

Why it matters now

EPSS 0.02476 84th percentileScored 2026-11-07
Fix Fixed rails-html-sanitizer (RubyGems): 1.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—rails-html-sanitizer (RubyGems)before 1.0.31.0.3Patch availableGHSA-59c7-4xj2-hgvw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • rails-html-sanitizer (RubyGems) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-59c7-4xj2-hgvw

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:*up to 1.0.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*4.2.0Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*4.2.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*4.2.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*4.2.0 beta3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*4.2.0 beta4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*4.2.0 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*4.2.0 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*4.2.0 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*4.2.1Running onRails
  • cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:* Versions up to 1.0.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:* Versions 4.2.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:* Versions 4.2.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:* Versions 4.2.0 beta3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:* Versions 4.2.0 beta4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:* Versions 4.2.0 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:* Versions 4.2.0 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:* Versions 4.2.0 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Running on ·Rails
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*4.2.1 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*4.2.1 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*4.2.1 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*4.2.1 rc4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*4.2.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*4.2.3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*4.2.3 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*4.2.4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*4.2.4 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*4.2.5Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*4.2.5 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*4.2.5 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*4.2.5.1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*4.2.5.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*4.2.6 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*5.0.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*5.0.0 beta1.1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*5.0.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*5.0.0 beta3Running onRails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:* Versions 4.2.1 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:* Versions 4.2.1 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:* Versions 4.2.1 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:* Versions 4.2.1 rc4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:* Versions 4.2.3 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:* Versions 4.2.4 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:* Versions 4.2.5 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:* Versions 4.2.5 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:* Versions 4.2.5.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:* Versions 4.2.5.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:* Versions 4.2.6 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:* Versions 5.0.0 beta1.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:* Versions 5.0.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:* Versions 5.0.0 beta3 Running on ·Rails

Remediation

  • Fix · GHSA-59c7-4xj2-hgvw rails-html-sanitizer (RubyGems) Fixed in 1.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7578
  2. 2026-10-03 Alias added: GHSA-59c7-4xj2-hgvw

References

Advisory 6

Other 5

  • TI-2015-06304 Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the… CVSS 3.0MEDIUM 6.1
  • TI-2015-06303 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby… CVSS 3.0MEDIUM 6.1
  • TI-2018-02738 Cross-site scripting in rails-html-sanitizer CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences