Skip to content
Fencer Vulns
medium 6.1

CVE-2022-32209 json

Rails::Html::Sanitizer vulnerable to Cross-site Scripting

published 2022-06-24 4 y ago modified 2026-06-17 4 mo ago also GHSA-pg8v-g4xq-hww9 , EUVD-2022-6111

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
26.5%
EPSS 26.5% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).

Patch / fix

  • rubygems rails-html-sanitizer 1.4.3
  • rubyonrails rails_html_sanitizers 1.4.3
  • ruby-rails-html-sanitizer Debian 14, Debian 13, Debian 12 1.4.3-0.1

debian advisories DEBIAN-CVE-2022-32209

  • foreman satellite utils 6.12, satellite capsule 6.12, satellite 6.12 3.3.0.17-1.el8sat
  • candlepin satellite 6.12 4.1.15-1.el8sat
  • foreman-cli satellite utils 6.12, satellite 6.12 3.3.0.17-1.el8sat
  • foreman-ec2 satellite 6.12 3.3.0.17-1.el8sat
  • foreman-gce satellite 6.12 3.3.0.17-1.el8sat
  • rubygem-git satellite 6.12 1.11.0-1.el8sat
  • foreman-ovirt satellite 6.12 3.3.0.17-1.el8sat
  • python-django satellite capsule 6.12, satellite 6.12 3.2.14-2.el8pc

red hat advisories RHSA-2022:8506

  • rubygem-rails-html-sanitizer OpenStack Cloud Crowbar 9, OpenStack Cloud Crowbar 8 1.0.3-8.11.1
  • rubygem-rails-html-sanitizer SLE High Availability Extension 15 SP4, SLE High Availability Extension 15 SP3, SLE High Availability Extension 15 SP2 +4 more 1.0.4-150000.4.3.1

suse advisories SUSE-SU-2022:2885-1SUSE-SU-2022:2870-1

  • rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.6.0-1.9
  • rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.6.0-1.7
  • rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.6.0-1.5
  • rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.4.3-1.1
  • ruby3.2-rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.5.0-2.1

opensuse advisories openSUSE-SU-2026:10361-1openSUSE-SU-2025:15125-1openSUSE-SU-2024:14175-1openSUSE-SU-2024:12145-1openSUSE-SU-2024:13137-1

  • libdb Rocky Linux 8 5.3.28-42.el8_4

rocky linux advisories RLSA-2022:8506

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-32209 updated cvss 5.3

rubygem-rails-html-sanitizer: possible xss with certain configurations

  • Red Hat Satellite 6.12 for RHEL 8 rubygem-rails-html-sanitizer 1.4.3-2.el8sat
    fixed: vendor fix RHSA-2022:8506
  • Red Hat Satellite 6.12 for RHEL 8 cjson 1.7.14-5.el8sat, libdb 5.3.28-42.el8_4, katello 4.5.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, +640 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

26.50% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • hackerone.com https://hackerone.com/reports/1530898 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
rubygems rails-html-sanitizer
<1.4.3
1.4.3

Affected products

  • n/a https://github.com/rails/rails-html-sanitizer

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.