Threats tagged 'ghsa-cpgf-5mjf-73p7'

A regular expression denial of service (ReDoS) vulnerability exists in rails-html-sanitizer versions 1.0.3 through before 1.7.2. The vulnerability arises from a regexp used to validate href attributes in SVG reference elements, which can cause quadratic-time processing on inputs with long whitespace runs. Only Ruby versions 3.1 and earlier are affected due to their regexp engine behavior. The default configuration is not affected unless SVG reference elements and their href attributes are explicitly allowed. The issue is fixed in version 1.7.2.