Vulnerabilities

TI-2023-18617 CVE-2023-36823 · GHSA-f5ww-cq3m-q3g7

Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

LOW 32

Sanitize is an allowlist-based HTML and CSS sanitizer.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00712 Published 2023-07-06 Fixed in 6.0.2 CWE-79

TI-2023-09456 CVE-2023-23627 · GHSA-fw3g-2h3j-qmm7

LOW 28

Sanitize is an allowlist-based HTML and CSS sanitizer.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00539 Published 2023-01-27 Fixed in 6.0.1 CWE-79

TI-2020-03543 CVE-2020-4054 · GHSA-p4x4-rw2p-8j8m

LOW 36

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.01917 Published 2020-06-16 Fixed in 5.2.1 CWE-79

TI-2018-02737 CVE-2018-3740 · GHSA-7f42-p84j-f58p

LOW 36

A specially crafted HTML fragment can cause Sanitize gem for Ruby to allow non-whitelisted attributes to be used on a whitelisted HTML element.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01468 Published 2018-03-30 Fixed in 4.6.3 CWE-79