Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability is due to the allowedtags function of sanitizer.rb which enables an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...