CVE-2026-73648
Received Received - Intake

Cross-Site Scripting via SVG in rails-html-sanitizer

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-73648
EUVD
EUVD-2026-58191

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
rails rails-html-sanitizer From 1.0.3 (inc) to 1.7.1 (exc)
rails rails-html-sanitizer 1.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects rails-html-sanitizer versions 1.0.3 to 1.7.1. It involves improper restriction of SVG reference elements. The sanitizer only blocked external references in xlink:href attributes but not in plain href attributes, which browsers also accept. This allowed malicious SVG content with external href references to bypass sanitization.

Detection Guidance

Check your rails-html-sanitizer gem version with 'bundle list rails-html-sanitizer' or 'gem list rails-html-sanitizer'. If the version is between 1.0.3 and 1.7.0, the system is vulnerable. Review application code for custom SVG tag configurations in sanitizer whitelists.

Impact Analysis

The vulnerability could allow cross-site scripting (XSS) if applications override default allowed tags to include SVG reference elements like use or feImage. A same-origin external SVG referenced by use could execute scripts in the sanitized document's context. feImage could load external images for tracking.

Mitigation Strategies

Upgrade rails-html-sanitizer to version 1.7.1 or higher using 'bundle update rails-html-sanitizer'. If using custom SVG tags, remove them from allowed tags list. Ensure Loofah dependency is at least 2.25.2.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73648. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart