PT-2024-35998 · Rails+2 · Rails+2

Mokusou + 2 · Published 2024-12-02 · Updated 2026-04-17 · CVE-2024-53986

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0

Description: A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math" and "style" elements are both explicitly allowed. This issue is relevant when used with Rails >= 7.1.0. The default configuration is to disallow these elements, and code is only impacted if allowed tags are being overridden.

Recommendations: For rails-html-sanitizer version 1.6.0, upgrade to version 1.6.1 to fix the vulnerability. As a temporary workaround, consider removing "math" or "style" from the overridden allowed tags, or downgrade sanitization to HTML4 by configuring config.action view.sanitizer vendor and config.action text.sanitizer vendor accordingly.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-04578

CVE-2024-53986

GHSA-638J-PMJW-JQ48

OPENSUSE-SU-2026:10569-1

Affected Products

Rails

Red Os

Rails-Html-Sanitizer

References · 29

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53986.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53986.yml · Exploit
• https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e · Patch
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-638j-pmjw-jq48 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53986 · Security Note
• https://osv.dev/vulnerability/GHSA-638j-pmjw-jq48 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04578 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53986 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10569-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53986 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53986 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53986 · Security Note
• https://github.com/rails/rails-html-sanitizer · Note
• https://suse.com/security/cve/CVE-2024-53988 · Note
• https://redos.red-soft.ru/support/secure · Note