Rails HTML Sanitizers XSS in SVG reference elements

Executive brief

A vulnerability exists in the Rails HTML sanitization library when it is configured to allow certain SVG elements. If an application is configured to permit tags like <use> or <feImage>, an attacker could bypass security filters to load external content. This could lead to malicious scripts running in a user's browser or unauthorized tracking of user activity.

Technical details

A cross-site scripting (XSS) vulnerability exists in Rails::HTML::PermitScrubber. The scrubber was designed to restrict SVG reference elements to local, same-document references by filtering the 'xlink:href' attribute. However, it failed to account for the plain 'href' attribute supported by the SVG 2 specification. An attacker can use the 'href' attribute in elements like <use> to reference external SVG documents. If the referenced document is same-origin and contains scripts, they may execute in the context of the sanitized document. This issue only affects applications that have overridden the default allowed tags to include SVG reference elements. The vulnerability is fixed in version 1.7.1.

Affected products

• Rails rails-html-sanitizer >= 1.0.3, < 1.7.1

Timeline

• 2026-07-16: patched: Version 1.7.1 released
• 2026-07-21: advisory: GitHub Advisory published

References

• https://api.github.com/users/flavorjones
• https://github.com/flavorjones
• https://api.github.com/users/flavorjones/gists%7B/gist_id%7D
• https://api.github.com/users/flavorjones/repos
• https://avatars.githubusercontent.com/u/8207?v=4
• https://api.github.com/users/flavorjones/events%7B/privacy%7D