Read the docs
TI-2015-06304 Aliases CVE-2015-7580GHSA-ghqm-pgxj-37gq

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.

Why it matters now

EPSS 0.02188 82nd percentileScored 2026-11-07
Fix Fixed rails-html-sanitizer (RubyGems): 1.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—rails-html-sanitizer (RubyGems)before 1.0.31.0.3Patch availableGHSA-ghqm-pgxj-37gq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • rails-html-sanitizer (RubyGems) Vendor— Affected before 1.0.3 Fixed in 1.0.3 Patch available GHSA-ghqm-pgxj-37gq

CPE configurations NVD · 29

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:*up to 1.0.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*4.2.0Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*4.2.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*4.2.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*4.2.0 beta3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*4.2.0 beta4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*4.2.0 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*4.2.0 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*4.2.0 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*4.2.1Running onRails
  • cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:* Versions up to 1.0.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:* Versions 4.2.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:* Versions 4.2.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:* Versions 4.2.0 beta3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:* Versions 4.2.0 beta4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:* Versions 4.2.0 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:* Versions 4.2.0 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:* Versions 4.2.0 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Running on ·Rails
Show 19 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*4.2.1 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*4.2.1 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*4.2.1 rc3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*4.2.1 rc4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*4.2.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*4.2.3Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*4.2.3 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*4.2.4Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*4.2.4 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*4.2.5Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*4.2.5 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*4.2.5 rc2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*4.2.5.1Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*4.2.5.2Running onRails
cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*4.2.6 rc1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*5.0.0 beta1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*5.0.0 beta1.1Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*5.0.0 beta2Running onRails
cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*5.0.0 beta3Running onRails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:* Versions 4.2.1 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:* Versions 4.2.1 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:* Versions 4.2.1 rc3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:* Versions 4.2.1 rc4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:* Versions 4.2.3 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:* Versions 4.2.4 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:* Versions 4.2.5 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:* Versions 4.2.5 rc2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:* Versions 4.2.5.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:* Versions 4.2.5.2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:* Versions 4.2.6 rc1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:* Versions 5.0.0 beta1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:* Versions 5.0.0 beta1.1 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:* Versions 5.0.0 beta2 Running on ·Rails
  • cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:* Versions 5.0.0 beta3 Running on ·Rails

Remediation

  • Fix · GHSA-ghqm-pgxj-37gq rails-html-sanitizer (RubyGems) Fixed in 1.0.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7580
  2. 2026-10-03 Alias added: GHSA-ghqm-pgxj-37gq

References

Advisory 4

Other 5

  • TI-2015-06303 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby… CVSS 3.0MEDIUM 6.1
  • TI-2015-06302 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for… CVSS 3.0MEDIUM 6.1
  • TI-2018-02738 Cross-site scripting in rails-html-sanitizer CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences