Windshock

**Name of the Vulnerable Software and Affected Versions** Rails::Html::Sanitizer versions prior to 1.4.3 **Description** The issue is related to the incorrect use of `select` and `style` elements when overriding allowed tags in the HTML sanitizer for Rails applications. This can allow a remote attacker to conduct cross-site scripting attacks. The vulnerability is exploited when the application developer has overridden the sanitizer's allowed tags to include both `select` and `style` elements. This can be done through various means, such as application configuration, using the `sanitize` helper with a `:tags` option, or directly with `Rails::Html::SafeListSanitizer`. **Recommendations** For versions prior to 1.4.3, upgrade to version 1.4.3 or later. As a temporary workaround, consider removing either `select` or `style` from the overridden allowed tags to prevent exploitation.