CVE-2026-73648

Name	CVE-2026-73648
Description	rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ruby-rails-html-sanitizer (PTS)	bullseye	1.3.0-1	vulnerable
	bullseye (security)	1.3.0-1+deb11u1	vulnerable
	bookworm	1.4.4-1	vulnerable
	trixie	1.6.2-1	vulnerable
	forky	1.7.0-2	vulnerable
	sid	1.7.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ruby-rails-html-sanitizer	source	(unstable)	1.7.1-1

Notes

https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cj75-f6xr-r4g7
https://github.com/rails/rails-html-sanitizer/pull/223
Fixed by: https://github.com/rails/rails-html-sanitizer/commit/74dcb8053e6da9921246ce71b06ad9fd65b19586 (v1.7.1)