CVE-2018-3741

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Rails	rails-html-sanitizer	<= 1.0.3

References

https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56aeIssue Tracking, Patch, Third Party Advisory
https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56aeIssue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-37436.1Open redirect in hekto <=0.2.3 when target domain name is used as html filename on server.CVE-2018-37449.8The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.CVE-2018-37459.1atob 2.0.3 and earlier allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.CVE-2018-37469.8The pdfinfojs NPM module versions <= 0.3.6 has a command injection vulnerability that allows an attacker to execute arbitrary commands on th CVE-2018-37476.1The public node module versions <= 1.0.3 allows to embed HTML in file names, which (in certain conditions) might lead to execute malicious J CVE-2018-37486.1There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name, which contains malicious HTML (eg. embedded ifra CVE-2018-37499.8The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attack CVE-2018-37509.8The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when th CVE-2018-37519.8The utilities function in all versions <= 0.3.0 of the merge-recursive node module can be tricked into modifying the prototype of Object whe CVE-2018-37529.8The utilities function in all versions <= 1.0.0 of the merge-options node module can be tricked into modifying the prototype of Object when CVE-2018-37539.8The utilities function in all versions <= 1.0.0 of the merge-objects node module can be tricked into modifying the prototype of Object when CVE-2018-37548.8Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user