RAILS-HTML-SANITIZER · CVE-2026-128068 · Package
FIX → 1.7.2
rails-html-sanitizer's PermitScrubber uses a regular expression that takes quadratic time on long runs of whitespace in SVG href attributes. An attacker who submits such HTML can consume CPU out of proportion to the input size, slowing or stalling the sanitizing process.
first public Nov 2, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications are exposed only when the allowed tags are overridden to include an SVG reference element such as use, along with href or xlink:href in allowed attributes, and only on Ruby 3.1 or earlier. The default configuration includes no SVG elements and is not affected. Teams that use Loofah directly should check its own copy of the check.
Not affected if default-config, managed-hosting, ruby-3.2-or-later
Who cares loofah, rails, rails-html-sanitizer, ruby
ruby --version; affected only on Ruby 3.1 and earlier, since Ruby 3.2 and later match the pattern in linear time.rails-html-sanitizer between 1.0.3 and 1.7.2 (exclusive of 1.7.2).Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.
>= 1.0.3, < 1.7.2< 1.0.31.7.2Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.
An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or is a long run of whitespace.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
use (an SVG reference element) together with href or xlink:href in allowed attributes.2.25.3.Upgrade to 1.7.2
rails-html-sanitizer 1.7.22.25.3 for applications that use Loofah directlyxlink:hrefApplications are affected only when the allowed tags are overridden to include an SVG reference element such as use, along with href or xlink:href in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3.
Run Ruby 3.2 or later, which matches the pattern in linear time, or remove the SVG reference elements from the overridden allowed tags.
Reported by scyoon through the Rails HackerOne program.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.