TI-2022-07579 Aliases CVE-2022-23520 GHSA-rrfc-7g8p-99q8

rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

LOW 30CWE-79Published 2022-12-14 · Updated 2025-11-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both "select" and "style" should either upgrade or use this workaround: Remove either "select" or "style" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.

Why it matters now

EPSS 0.01185 68th percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by NVD

Fix Partial rails-html-sanitizer (rails): 1.4.4rails-html-sanitizer (RubyGems): 1.4.4Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Rails	rails-html-sanitizer	before 1.4.4	1.4.4	Patch available	CNA
—	rails-html-sanitizer (RubyGems)	before 1.4.4	1.4.4	Patch available	GHSA-rrfc-7g8p-99q8

rails-html-sanitizer VendorRails Affected before 1.4.4 Fixed in 1.4.4 Patch available CNA
rails-html-sanitizer (RubyGems) Vendor— Affected before 1.4.4 Fixed in 1.4.4 Patch available GHSA-rrfc-7g8p-99q8

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:rubyonrails:rails_html_sanitizers::::::rails::*	before 1.4.4	Vulnerable	Rails
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian

cpe:2.3:a:rubyonrails:rails_html_sanitizers:*:*:*:*:*:rails:*:* Versions before 1.4.4 Vulnerable ·Rails
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

Fix · CNA rails-html-sanitizer (rails) Fixed in 1.4.4
Fix · GHSA-rrfc-7g8p-99q8 rails-html-sanitizer (RubyGems) Fixed in 1.4.4 Advisory →

Red Hat 1 advisory

RHSA-2023:2097 Released 2023-05-03 · Red Hat rating Important
Satellite 6.13 Release
- Red Hat Satellite 6.13 for RHEL 8 ansible-collection-redhat-satellite-3.9.0-2.el8sat, ansible-collection-redhat-satellite_operations-1.3.0-2.el8sat, ansible-lint-5.0.8-4.el8pc +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat 3scale API Management Platform 2	Affected	No fix planned: Will not fix
Red Hat Satellite 6	Affected	No fix yet
Red Hat Satellite 6.13 for RHEL 8	Fixed	RHSA-2023:2097

Not affected: 1 product

Red Hat Satellite 6.13 for RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2022-23520
2026-10-03 Alias added: GHSA-rrfc-7g8p-99q8

References

Exploit 2

Advisory 2

Other 3

TI-2022-13919 Cross-site scripting in https://github.com/rails/rails-html-sanitizer CVSS 3.1MEDIUM 6.1
TI-2024-36144 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVSS 4.0LOW 2.3
TI-2022-07576 Inefficient Regular Expression Complexity in rails-html-sanitizer CVSS 3.1HIGH 7.5
TI-2022-07578 Possible XSS vulnerability with certain configurations of rails-html-sanitizer CVSS 3.1HIGH 7.2
TI-2022-07577 Improper neutralization of data URIs allows XSS in rails-html-sanitizer CVSS 3.1MEDIUM 6.1
TI-2024-36148 Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 CVSS 4.0LOW 2.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences