RAILS-HTML-SANITIZER · CVE-2026-128069 · Package
FIX → 1.7.2
rails-html-sanitizer shares one scrubber across sanitize calls in a process, so concurrent calls with different allowlists can interleave. An attacker can get a permissive allowlist applied to another request, letting script tags or event-handler attributes through to stored or rendered output (cross-site scripting).
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Rails applications that run multiple threads per process and call sanitize with different tags or attributes options, including calls that use defaults. Applications using one allowlist everywhere, passing their own scrubber, or running single-threaded are not affected.
Not affected if custom-scrubber, single-configuration, single-threaded
Who cares multi-threaded, puma, rails, ruby
bundle exec gem list rails-html-sanitizer or in Gemfile.lock; affected below 1.7.2.sanitize calls that pass tags: or attributes: options, or that use no options while other calls differ.Upgrade to 1.7.2
Rails::HTML::SafeListSanitizer (both the HTML4 and HTML5 variants) shares one Rails::HTML::PermitScrubber across every sanitize call on the same instance, assigning its tags and attributes on each call without synchronization. Two concurrent sanitize calls with different tags: or attributes: options can interleave, so one call is scrubbed with the other call's allowlist.
< 1.7.21.7.2Action View memoizes a single SafeListSanitizer per helper module and uses it for every sanitize call in the process, so in a multi-threaded server (for example Puma) all requests share the same . If any code path calls with a more permissive allowlist, an attacker who can trigger that path concurrently with another request can cause the other request to be sanitized with the permissive allowlist. If the permissive allowlist admits or an event-handler attribute, the strict call emits it unchanged, which is a cross-site scripting vector when the strict output is stored or rendered to other users.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.7.2PermitScrubbersanitizescriptApplications are affected only if they run more than one thread per process and some sanitize call passes tags: or attributes: options that differ from another call's, including a call that passes no options and so uses the defaults. Applications that use a single configuration everywhere, pass their own scrubber:, or run single-threaded are not affected.
Use the same allowlist for every sanitize call, or pass a scrubber: built per call (Rails::HTML::PermitScrubber.new with tags= and attributes= set) instead of tags: and attributes: options.
Reported by hiumee via HackerOne.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.