CVE-2026-73648 in rails-html-sanitizer
Summary
by MITRE • 08/13/2026
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in rails-html-sanitizer affects versions 1.0.3 through 1.7.1 and relates to improper handling of SVG reference elements during HTML sanitization processes. The core flaw exists within the Rails::HTML::PermitScrubber component which is designed to sanitize HTML fragments in Rails applications. This scrubber implements restrictions on SVG local href attributes but demonstrates inconsistent behavior regarding attribute recognition, specifically failing to properly restrict the plain href attribute while correctly handling xlink:href. The vulnerability stems from the fact that modern web browsers accept both href and xlink:href attributes for referencing external resources within SVG elements, yet the sanitization logic only addressed one of these attributes.
When applications utilize non-default allowed tags that include SVG elements such as use or feImage, the incomplete sanitization creates security risks through bypass mechanisms. The use element in SVG can reference external SVG documents through the href attribute, potentially allowing execution of malicious scripts within the context of the sanitized document's origin. This represents a cross-site scripting vulnerability where external content loaded via SVG references could execute code with the privileges of the hosting application. Additionally, the feImage element can load external images for tracking purposes, creating potential privacy violations through covert data exfiltration mechanisms.
The operational impact of this vulnerability extends beyond simple script execution to encompass broader security implications within web applications that process user-supplied HTML content. Applications using default allowed tags remain unaffected because these tags do not include SVG elements that could be exploited, but custom configurations that permit SVG functionality create exposure windows. The vulnerability represents a failure in the principle of least privilege during sanitization operations where external references should be uniformly restricted regardless of attribute naming conventions. This flaw demonstrates inadequate input validation and filtering mechanisms that fail to account for browser compatibility variations in attribute handling.
Security mitigations for this vulnerability require immediate application updates to version 1.7.1 or later, which properly addresses the inconsistent attribute handling by implementing comprehensive restrictions on both href and xlink:href attributes within SVG elements. Organizations should also conduct thorough code reviews of custom sanitization configurations to identify any non-default tag allowances that might create similar exposure points. The fix aligns with security best practices for input sanitization and follows established principles from the CWE database category 1004 which addresses inadequate restriction of XML external entity references, though this specifically affects HTML sanitization rather than XML parsing. From an ATT&CK framework perspective, this vulnerability maps to techniques involving client-side code injection and tracking through external resource loading, emphasizing the importance of proper context-aware sanitization in web application security controls.