Read the docs
TI-2020-03543 Aliases CVE-2020-4054GHSA-p4x4-rw2p-8j8m

Cross-site Scripting in Sanitize

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

Why it matters now

EPSS 0.01917 79th percentileScored 2026-11-07
Fix Fixed Sanitize (rgrove): 5.2.1sanitize (RubyGems): 5.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
rgroveSanitize3.0.0 to before 5.2.15.2.1Patch availableCNA
—sanitize (RubyGems)3.0.0 to before 5.2.15.2.1Patch availableGHSA-p4x4-rw2p-8j8m
  • Sanitize Vendorrgrove Affected 3.0.0 to before 5.2.1 Fixed in 5.2.1 Patch available CNA
  • sanitize (RubyGems) Vendor— Affected 3.0.0 to before 5.2.1 Fixed in 5.2.1 Patch available GHSA-p4x4-rw2p-8j8m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*3.0.0 to before 5.2.1Vulnerablergrove
  • cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:* Versions 3.0.0 to before 5.2.1 Vulnerable ·rgrove

Remediation

  • Fix · CNA Sanitize (rgrove) Fixed in 5.2.1
  • Fix · GHSA-p4x4-rw2p-8j8m sanitize (RubyGems) Fixed in 5.2.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4054
  2. 2026-10-03 Alias added: GHSA-p4x4-rw2p-8j8m

References

Patch 1

Advisory 5

Other 3

  • TI-2018-02737 Cross-site scripting in Ryan Grove sanitize CVSS 3.0HIGH 7.5
  • TI-2023-18617 Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVSS 3.1HIGH 7.1
  • TI-2023-09456 Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences