A concurrency issue in rails-html-sanitizer versions prior to 1.7.2 allows cross-site scripting (XSS) via shared scrubber state during concurrent sanitize calls with differing allowlists. The vulnerability arises because the PermitScrubber instance is shared and its tags and attributes are reassigned without synchronization, causing one request's sanitizer to use another's permissive allowlist. This affects multi-threaded Ruby on Rails applications using the default sanitizer configuration. The issue is fixed in version 1.7.2.