CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2018-3741
Medium (6.1) in rubyonrails html sanitizer. EPSS 1.3% chance of exploitation in the next 30 days. Fixed in rails-html-sanitizer 1.0.4.
There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rubyonrails:html_sanitizer
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-px3r-jm9g-c8w8 | RubyGems | rails-html-sanitizer | <1.0.4 | 1.0.4 |