CVE-2026-73648 vulnerabilities

Vulnerabilities for packages: ruby3.3-rails, gitlab-rails-ce-fips, commercial-gitlab-rails-ee, ruby4.0-rails, ruby3.4-rails, ruby3.2-rails, pghero-fips, gitlab-rails-ce, commercial-gitlab-rails-ee-fips, pghero...

CVE-2026-73648 vulnerabilities

Vulnerabilities for packages: ruby3.2-rails, ruby3.4-rails, ruby4.0-rails...

DEBIAN-CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648

The provided details describe a vulnerability in rails-html-sanitizer (affecting Rails 1.0.3 through 1.7.1) where the PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only if xlink:href was used, though browsers accept plain href. This could allow external references for n...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...