CVE-2026-73648 rails-html-sanitizer: Possible XSS vulnerability with certain configurations
Attackers can execute scripts or track users via SVG elements in Rails applications using non-default allowed tags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-73648?
CVE-2026-73648 is a medium-severity cross-site scripting vulnerability in rails-html-sanitizer, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
Weakness: CWE-79
Which versions are affected by CVE-2026-73648?
2 open source packages ship an affected version, including rails-html-sanitizer.
| Package | Affected | Fixed in |
|---|---|---|
rails-html-sanitizer RubyGems | From 1.0.3 | 1.7.1 |
rails-html-sanitizer RubyGems | From 1.0.3 | 1.7.1 |
Linux distribution packages (4)
rubygem-rails-html-sanitizer SUSE:Linux Enterprise High Availability Extension 15 SP4 | All versions | 1.0.4-150000.4.9.1 |
rubygem-rails-html-sanitizer SUSE:Linux Enterprise High Availability Extension 15 SP5 | All versions | 1.0.4-150000.4.9.1 |
rubygem-rails-html-sanitizer SUSE:Linux Enterprise High Availability Extension 15 SP6 | All versions | 1.0.4-150000.4.9.1 |
rubygem-rails-html-sanitizer SUSE:Linux Enterprise High Availability Extension 15 SP7 | All versions | 1.0.4-150000.4.9.1 |
How do I fix CVE-2026-73648?
Upgrade rails-html-sanitizer to 1.7.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-73648 being exploited?
There is no known exploitation of CVE-2026-73648 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-73648, GHSA-cj75-f6xr-r4g7, SUSE-SU-2026:4445-1, UBUNTU-CVE-2026-73648.