Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 8.1.0.beta1, < 8.1.4.1
Patched in 8.1.4.1
Vulnerable: < 8.0.5.2
Patched in 8.0.5.2
Details
With the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected.
The fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes < and > in attribute values as < and >, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization.
Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer.
The fixed releases are available at the normal locations.
Patches for those who cannot upgrade at once:
This issue was responsibly reported by HackerOne researcher azaran. This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).
EPSS, exploit probability
Low0.34%
estimated chance of real-world exploitation in the next 30 days, higher than 27.6% of every CVE FIRST.org scores
Refreshed 11/13/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
More rubygems advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.