GHSA-V6RJ-XM57-3P59 Action View: Possible XSS vulnerability in highlight helper

Impact ActionView::Helpers::TextHelperhighlight substitutes each matched phrase into the :highlighter string without escaping it and returns the result marked HTML-safe. Because sanitizing leaves quote characters in text unescaped, a match substituted into a quoted attribute value of the...