Threats tagged 'ghsa-rq8q-p985-fjq7'

A cross-site scripting (XSS) vulnerability exists in Action View's strip_tags method where it marks sanitized output as html_safe but does not encode quotes, allowing untrusted input rendered inside quoted HTML attributes to inject malicious attributes. This affects applications that use strip_tags output inside HTML attribute values, such as title or meta content attributes. The issue is fixed in versions 8.1.4.1 and 8.0.5.2 by encoding quotes in the output. Workarounds include passing strip_tags output through tag helpers that escape attribute values.