CVE-2024-53986 json
Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
published 2024-12-02 23 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-3433 , GHSA-638j-pmjw-jq48
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.
Patch / fix
- rubygems rails-html-sanitizer 1.6.1
- rubyonrails html_sanitizer 1.6.1
- rubyonrails rails_html_sanitizers 1.6.1
- rubygem-rails-html-sanitizer openSUSE Tumbleweed 1.7.0-1.1
opensuse advisories openSUSE-SU-2026:10569-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-53986 updated cvss 3.1
rails-html-sanitizer: Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0
-
Red Hat 3scale API Management Platform 2 3scale-amp2/zync-rhel8 Red Hat Satellite 6 rubygem-rails-html-sanitizeraffected: no fix available “Fix deferred”
-
Red Hat 3scale API Management Platform 2 3scale-amp2/system-rhel7 Red Hat Satellite 6 rubygem-rails-html-sanitizernot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | rails-html-sanitizer | >=1.6.0, <1.6.1 |
1.6.1 |
Affected products
- rails rails-html-sanitizer
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
- Technology feeds
References
-
github.com
/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e
web, patch
-
github.com
/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-53986
advisory
-
github.com
/rails/rails-html-sanitizer
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53986.yml
web
Sources
- CVE List CVE-2024-53986
- GitHub Advisory GHSA-638j-pmjw-jq48
- NVD CVE-2024-53986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.