DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

GHSA-CJ75-F6XR-R4G7: GHSA-cj75-f6xr-r4g7: Cross-Site Scripting (XSS) Bypass via SVG href Attributes in rails-html-sanitizer

#security #cve #cybersecurity #ghsa

GHSA-cj75-f6xr-r4g7: Cross-Site Scripting (XSS) Bypass via SVG href Attributes in rails-html-sanitizer

Vulnerability ID: GHSA-CJ75-F6XR-R4G7
CVSS Score: 5.1
Published: 2026-07-21

An issue in rails-html-sanitizer allowed attackers to bypass restrictions on SVG reference elements (such as or ) when specific custom configurations allowed these tags. Because the sanitizer only restricted the legacy 'xlink:href' attribute to local references, modern browsers supporting plain 'href' attributes according to the SVG 2 specification would load external resources. This could lead to Cross-Site Scripting (XSS) or user tracking.

TL;DR

Custom configurations of rails-html-sanitizer allowing SVG reference tags were vulnerable to XSS and tracking because plain 'href' attributes bypassed local-reference filters restricted only to 'xlink:href'.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-79
  • Attack Vector: Network
  • CVSS v4 Score: 5.1 (Medium)
  • Exploit Status: poc
  • KEV Status: Not Listed
  • Component: rails-html-sanitizer

Affected Systems

  • Ruby on Rails applications using custom rails-html-sanitizer configurations allowing SVG elements
  • rails-html-sanitizer: >= 1.0.3, < 1.7.1 (Fixed in: 1.7.1)

Code Analysis

Commit: 74dcb80

Fix XSS vulnerability with certain configurations by checking all SVG href attributes

--- a/lib/rails/html/scrubbers.rb
+++ b/lib/rails/html/scrubbers.rb
@@ -172,7 +172,7 @@ def scrub_attribute(node, attr_node)
             Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
           end

-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && attr_name == "xlink:href" && attr_node.value =~ /^\s*[^#\s].*/m
+          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
             attr_node.remove
           end
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • rails-html-sanitizer test suite: The test suite includes functional PoCs proving that external plain href tags in allow arbitrary external resources to load.

Mitigation Strategies

  • Upgrade rails-html-sanitizer to version 1.7.1 or higher.
  • Audit custom sanitization lists to ensure and elements are not allowed.
  • Deploy a custom scrubber to programmatically block SVG reference elements if immediate upgrade is impossible.

Remediation Steps:

  1. Modify Gemfile to specify gem 'rails-html-sanitizer', '>= 1.7.1'.
  2. Run 'bundle update rails-html-sanitizer loofah'.
  3. Verify that the resolved loofah version is 2.25.2 or higher.
  4. Inspect application sanitizers for custom tag overrides permitting 'use' or 'feImage'.

References

Read the full report for GHSA-CJ75-F6XR-R4G7 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)