CVE-2024-53986

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This vulnerability is fixed in 1.6.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-539876.1rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain CVE-2024-539886.1rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain CVE-2024-539896.1rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain CVE-2024-53997.2Openfind Mail2000 does not properly filter parameters of specific API. Remote attackers with administrative privileges can exploit this vuln CVE-2024-539909.2The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When m CVE-2024-539915.9Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use `FileSt CVE-2024-539928.8unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that a CVE-2024-539944.3Discourse is an open source platform for community discussion. In affected versions users who disable chat in preferences could still be rea CVE-2024-539951.9SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content CVE-2024-539995.4Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dyna CVE-2024-54008.8Openfind Mail2000 does not properly filter parameters of specific CGI. Remote attackers with regular privileges can exploit this vulnerabili CVE-2024-540007.5Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dyna