Threats tagged 'ghsa-2p2f-4rq4-gjwc'

A cross-site scripting (XSS) vulnerability exists in the Action View text helpers `highlight` and `simple_format` when used with the HTML5 sanitizer in Rails applications using load_defaults 7.1 or later. The issue arises because Nokogiri before version 1.19.5 does not escape `<` and `>` characters inside attribute values, allowing potentially unsafe markup to be emitted as live HTML elements. This can lead to XSS when untrusted input is passed to these helpers. Fixed versions of Rails require rails-html-sanitizer 1.7.2 or later, which depends on Nokogiri 1.19.5 or newer that properly escapes these characters. Workarounds include upgrading Nokogiri or switching to the HTML4 sanitizer.