java-html-sanitizer

OWASP Java HTML Sanitizer Un sanitizador de HTML rápido y fácil de configurar escrito en Java que te permite incluir HTML generado por terceros en tu aplicación web mientras te proteges contra XSS. La dependencia existente es de JSR 305. Los otros archivos JAR solo son necesarios para el conjunto...

bluemonday

bluemonday bluemonday es un sanitizador HTML implementado en Go. Es rápido y altamente configurable. bluemonday toma contenido generado por usuarios no confiable como entrada, y devolverá HTML saneado contra una lista blanca de elementos y atributos HTML aprobados para que puedas incluir el...

HTMLawed

HTMLawed es ... ... un script PHP de un solo archivo de 45 kb que hace que el texto de entrada sea más seguro, conforme a los estándares HTML y, en general, adecuado desde el punto de vista del administrador de una página web, para su uso en el cuerpo de documentos HTML, XHTML o XML. Una sencilla...

OWASPBugBounty

Programa de Bug Bounty de OWASP para Proyectos Introducción Muchos desarrolladores y empresas que buscan implementar seguridad están recurriendo a OWASP para utilizar librerías Defender que puedan implementar para proteger sus aplicaciones críticas. Dado que esto implica una forma de confianza en...

sanitize

Sanitize Sanitize is an allowlist-based HTML and CSS sanitizer. It removes all HTML and/or CSS from a string except the elements, attributes, and properties you choose to allow. Using a simple configuration syntax, you can tell Sanitize to allow certain HTML elements, certain attributes within...

TYPO3-HTML-Sanitizer-XSS-CVE-2023-47125

TYPO3 HTML Sanitizer 中的存储型 XSS（利用）（CVE-2023-47125） 描述 DOM 处理指令未正确处理。这允许绕过 typo3/html-sanitizer 的跨站脚本机制。 受影响版本 = 1.0.0, = 2.0.0,...

bleach

Bleach 注意：2026-06-05：Bleach 已不再维护。未来将不会发布任何版本，包括安全问题的修复。 参见 Issue： Bleach 是一个基于允许列表的 HTML 清洗库，用于转义或去除标记和属性。 Bleach 还可以安全地将文本转换为链接，应用 Django 的 urlize 过滤器无法处理的过滤，并可选地设置 rel 属性，即使文本中已存在链接也是如此。 Bleach 旨在清洗来自不可信 来源的文本。如果您发现自己煞费苦心地让网站管理员做很多事情，那么您可能已经超出了使用场景。要么信任这些用户，要么不要。 由于它依赖于 html5lib，Bleach 在处理怪异、古...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer 1.4.4 use a inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Possible XSS Vulnerability in Rails::Html::Sanitizer There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This vulnerability has been assigned the CVE identifier CVE-2022-32209. Vulnerabilities affected: ALL Not affected: NONEMeaning: Fixed versions: v1.4.3...

Astra Linux – Vulnerability in ruby-rails-html-sanitizer

Rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions starting from 1.0.3 and before 1.4.4 are vulnerable to cross-site scripting through data URIs when used in conjunction with Loofah version 2.1.0 or higher. This issue has been fixed in version 1.4.4...

Astra Linux – Vulnerability in Firefox

The HTML Sanitizer should have sanitized the href attribute of SVG use tags; however, it incorrectly did not sanitize the xlink:href attributes. This vulnerability affects Firefox versions earlier than 102...

Astra Linux – Vulnerability in Firefox

tags that referenced a document from the same origin could have allowed script execution if the attacker’s input was sanitized using the HTML Sanitizer API. This would require the attacker to reference a JavaScript file from the same origin that contained the script to be executed. This...

ANT-2026-MHJX7J31 · typo3 · XSS

xss medium CVE-2026-47345 GHSA-p5j5-4j3q-8mq8 Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Doyensec. ANT-2026-MHJX7J31: Stored XSS in TYPO3...

CVE-2026-75000

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation...

SUSE CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648

A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting XSS by exploiting improper sanitization of SVG Scalable Vector Graphics reference elements. The...

Linux Distros Unpatched Vulnerability : CVE-2026-73648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG...

DEBIAN-CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...