| Package | Affected versions | Patched versions |
|---|---|---|
| rails-html-sanitizer | ≥ 1.0.3, < 1.4.4 | 1.4.4 |
| loofah | ≥ 2.1.0, < 2.19.1 | 2.19.1 |
| rails html sanitizers | ≥ 1.0.3, < 1.4.4 | 1.4.4 |
rails-html-sanitizer >= 1.0.3, < 1.4.4 is vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0.
Upgrade to rails-html-sanitizer >= 1.4.4.
The maintainers have evaluated this as Medium Severity 6.1.
This vulnerability was independently reported by Maciej Piechota (@haqpl) and Mrinmoy Das (@goromlagche).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free