Read the docs
TI-2015-06303 Aliases CVE-2015-7579GHSA-r9c2-cr39-c8g6

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via an HTML entity that is mishandled by the Rails::Html::FullSanitizer class.

Why it matters now

EPSS 0.02577 85th percentileScored 2026-11-07
Fix Fixed rails-html-sanitizer (RubyGems): 1.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—rails-html-sanitizer (RubyGems)before 1.0.31.0.3Patch availableGHSA-r9c2-cr39-c8g6
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • rails-html-sanitizer (RubyGems) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-r9c2-cr39-c8g6

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:*up to 1.0.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*4.2.0Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*4.2.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*4.2.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*4.2.0 beta3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*4.2.0 beta4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*4.2.0 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*4.2.0 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*4.2.0 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*4.2.1Running onRails
  • cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:* Versions up to 1.0.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:* Versions 4.2.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:* Versions 4.2.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:* Versions 4.2.0 beta3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:* Versions 4.2.0 beta4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:* Versions 4.2.0 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:* Versions 4.2.0 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:* Versions 4.2.0 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Running on ·Rails
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*4.2.1 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*4.2.1 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*4.2.1 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*4.2.1 rc4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*4.2.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*4.2.3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*4.2.3 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*4.2.4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*4.2.4 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*4.2.5Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*4.2.5 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*4.2.5 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*4.2.5.1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*4.2.5.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*4.2.6 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*5.0.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*5.0.0 beta1.1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*5.0.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*5.0.0 beta3Running onRails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:* Versions 4.2.1 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:* Versions 4.2.1 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:* Versions 4.2.1 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:* Versions 4.2.1 rc4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:* Versions 4.2.3 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:* Versions 4.2.4 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:* Versions 4.2.5 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:* Versions 4.2.5 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:* Versions 4.2.5.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:* Versions 4.2.5.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:* Versions 4.2.6 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:* Versions 5.0.0 beta1.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:* Versions 5.0.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:* Versions 5.0.0 beta3 Running on ·Rails

Remediation

  • Fix · GHSA-r9c2-cr39-c8g6 rails-html-sanitizer (RubyGems) Fixed in 1.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7579
  2. 2026-10-03 Alias added: GHSA-r9c2-cr39-c8g6

References

Advisory 6

Other 5

  • TI-2015-06304 Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the… CVSS 3.0MEDIUM 6.1
  • TI-2015-06302 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for… CVSS 3.0MEDIUM 6.1
  • TI-2018-02738 Cross-site scripting in rails-html-sanitizer CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences