TI-2022-07578 Aliases CVE-2022-23519 GHSA-9h9g-93gc-623h

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

LOW 34CWE-79Published 2022-12-14 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.

Why it matters now

EPSS 0.01055 64th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Partial rails-html-sanitizer (rails): 1.4.4rails-html-sanitizer (RubyGems): 1.4.4Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rails	rails-html-sanitizer	before 1.4.4	1.4.4	Patch available	CNA
—	rails-html-sanitizer (RubyGems)	before 1.4.4	1.4.4	Patch available	GHSA-9h9g-93gc-623h

rails-html-sanitizer VendorRails Affected before 1.4.4 Fixed in 1.4.4 Patch available CNA
rails-html-sanitizer (RubyGems) Vendor— Affected before 1.4.4 Fixed in 1.4.4 Patch available GHSA-9h9g-93gc-623h

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:rubyonrails:rails_html_sanitizers::::::rails::*	before 1.4.4	Vulnerable	Rails
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:rubyonrails:rails_html_sanitizers:*:*:*:*:*:rails:*:* Versions before 1.4.4 Vulnerable ·Rails
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA rails-html-sanitizer (rails) Fixed in 1.4.4
Fix · GHSA-9h9g-93gc-623h rails-html-sanitizer (RubyGems) Fixed in 1.4.4 Advisory →

Red Hat 1 advisory

RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
Satellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat 3scale API Management Platform 2	Affected	No fix planned: Will not fix
Red Hat Satellite 6	Affected	No fix yet
Red Hat Satellite 6.13 for RHEL 8	Fixed	RHSA-2023:2097

Not affected: 1 product

Red Hat Satellite 6.13 for RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2022-23519
2026-10-03 Alias added: GHSA-9h9g-93gc-623h

References

Exploit 2

Advisory 2

Other 3

TI-2022-13919 Cross-site scripting in https://github.com/rails/rails-html-sanitizer CVSS 3.1MEDIUM 6.1
TI-2024-36144 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVSS 4.0LOW 2.3
TI-2022-07576 Inefficient Regular Expression Complexity in rails-html-sanitizer CVSS 3.1HIGH 7.5
TI-2022-07579 rails-html-sanitizer contains an incomplete fix for an XSS vulnerability CVSS 3.1MEDIUM 6.1
TI-2022-07577 Improper neutralization of data URIs allows XSS in rails-html-sanitizer CVSS 3.1MEDIUM 6.1
TI-2024-36148 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVSS 4.0LOW 2.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences