TI-2023-09456 Aliases CVE-2023-23627 GHSA-fw3g-2h3j-qmm7

Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element

LOW 28CWE-79Published 2023-01-27 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows `noscript` elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00539 45th percentileScored 2026-11-07

Fix Fixed sanitize (rgrove): 6.0.1sanitize (RubyGems): 6.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rgrove	sanitize	5.0.0 to before 6.0.1	6.0.1	Patch available	CNA
—	sanitize (RubyGems)	5.0.0 to before 6.0.1	6.0.1	Patch available	GHSA-fw3g-2h3j-qmm7

sanitize Vendorrgrove Affected 5.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available CNA
sanitize (RubyGems) Vendor— Affected 5.0.0 to before 6.0.1 Fixed in 6.0.1 Patch available GHSA-fw3g-2h3j-qmm7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:sanitize_project:sanitize::::::ruby::*	5.0.0 to before 6.0.1	Vulnerable	rgrove

cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:* Versions 5.0.0 to before 6.0.1 Vulnerable ·rgrove

Remediation

Fix · CNA sanitize (rgrove) Fixed in 6.0.1
Fix · GHSA-fw3g-2h3j-qmm7 sanitize (RubyGems) Fixed in 6.0.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-23627
2026-10-03 Alias added: GHSA-fw3g-2h3j-qmm7

References

Advisory 2

Other 3

TI-2020-03543 Cross-site Scripting in Sanitize CVSS 3.1HIGH 7.3
TI-2018-02737 Cross-site scripting in Ryan Grove sanitize CVSS 3.0HIGH 7.5
TI-2023-18617 Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences