← Database

CVE-2022-23518

MEDIUM CVSS: 6.1 Published: 2022-12-14 Modified: 2026-06-17

Description

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.

Affected Platforms

Rubyonrails Rails Html SanitizersLoofah Project LoofahDebian Debian Linux

Weakness Type

CWE-79

References