TI-2018-02738 Aliases CVE-2018-3741 GHSA-px3r-jm9g-c8w8

Cross-site scripting in rails-html-sanitizer

LOW 30CWE-79Published 2018-03-30 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

Why it matters now

EPSS 0.01253 69th percentileScored 2026-11-07

Fix Partial rails-html-sanitizer (RubyGems): 1.0.4Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rails	rails-html-sanitizer	up to 1.0.3	—	No fix listed	CNA
—	rails-html-sanitizer (RubyGems)	before 1.0.4	1.0.4	Patch available	GHSA-px3r-jm9g-c8w8

rails-html-sanitizer VendorRails Affected up to 1.0.3 Fixed in — No fix listed CNA
rails-html-sanitizer (RubyGems) Vendor— Affected before 1.0.4 Fixed in 1.0.4 Patch available GHSA-px3r-jm9g-c8w8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:rubyonrails:html_sanitizer::::::ruby::*	up to 1.0.3	Vulnerable	Rails

cpe:2.3:a:rubyonrails:html_sanitizer:*:*:*:*:*:ruby:*:* Versions up to 1.0.3 Vulnerable ·Rails

Remediation

Fix · GHSA-px3r-jm9g-c8w8 rails-html-sanitizer (RubyGems) Fixed in 1.0.4 Advisory →

Red Hat 1 advisory

RHSA-2019:0212 Released 2019-02-07 · Red Hat rating Moderate
CloudForms 4.7 security, bug fix and enhancement update
- CloudForms Management Engine 5.10 ansible-runner-1.1.2-2.el7ar, ansible-tower-3.3.3-1.el7at, ansible-tower-server-3.3.3-1.el7at +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Software Collections	Affected	No fix planned: Will not fix
CloudForms Management Engine 5.10	Fixed	RHSA-2019:0212

Timeline

2026-10-02 Threatist record created from CVE-2018-3741
2026-10-03 Alias added: GHSA-px3r-jm9g-c8w8

References

TI-2015-06304 Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the… CVSS 3.0MEDIUM 6.1
TI-2015-06303 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby… CVSS 3.0MEDIUM 6.1
TI-2015-06302 Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences