Read the docs
TI-2023-18617 Aliases CVE-2023-36823GHSA-f5ww-cq3m-q3g7

Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Sanitize is an allowlist-based HTML and CSS sanitizer. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML and CSS through Sanitize starting with version 3.0.0 and prior to version 6.0.2 when Sanitize is configured to use the built-in "relaxed" config or when using a custom config that allows `style` elements and one or more CSS at-rules. This could result in cross-site scripting or other undesired behavior when the malicious HTML and CSS are rendered in a browser. Sanitize 6.0.2 performs additional escaping of CSS in `style` element content, which fixes this issue. Users who are unable to upgrade can prevent this issue by using a Sanitize config that doesn't allow `style` elements, using a Sanitize config that doesn't allow CSS at-rules, or by manually escaping the character sequence `</` as `<\/` in `style` element content.

Why it matters now

EPSS 0.00712 53rd percentileScored 2026-11-07
Fix Fixed sanitize (rgrove): 6.0.2sanitize (RubyGems): 6.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
rgrovesanitize3.0.0 to before 6.0.26.0.2Patch availableCNA
—sanitize (RubyGems)3.0.0 to before 6.0.26.0.2Patch availableGHSA-f5ww-cq3m-q3g7
  • sanitize Vendorrgrove Affected 3.0.0 to before 6.0.2 Fixed in 6.0.2 Patch available CNA
  • sanitize (RubyGems) Vendor— Affected 3.0.0 to before 6.0.2 Fixed in 6.0.2 Patch available GHSA-f5ww-cq3m-q3g7

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:*3.0.0 to before 6.0.2Vulnerablergrove
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:sanitize_project:sanitize:*:*:*:*:*:ruby:*:* Versions 3.0.0 to before 6.0.2 Vulnerable ·rgrove
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA sanitize (rgrove) Fixed in 6.0.2
  • Fix · GHSA-f5ww-cq3m-q3g7 sanitize (RubyGems) Fixed in 6.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36823
  2. 2026-10-03 Alias added: GHSA-f5ww-cq3m-q3g7

References

Patch 1

Advisory 2

Other 4

  • TI-2020-03543 Cross-site Scripting in Sanitize CVSS 3.1HIGH 7.3
  • TI-2018-02737 Cross-site scripting in Ryan Grove sanitize CVSS 3.0HIGH 7.5
  • TI-2023-09456 Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` element CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences