PT-2024-35999 · Rails+2 · Rails+2

Mokusou + 2 · Published 2024-12-02 · Updated 2026-04-17 · CVE-2024-53987

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0

Description: A possible XSS vulnerability exists with certain configurations of Rails::HTML::Sanitizer when used with Rails >= 7.1.0. This vulnerability may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the style element is explicitly allowed and the svg or math element is not allowed.

Recommendations: For rails-html-sanitizer version 1.6.0, upgrade to version 1.6.1 to fix the vulnerability. As a temporary workaround, consider removing style from the overridden allowed tags or downgrading sanitization to HTML4.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-04577

CVE-2024-53987

GHSA-2X5M-9CH4-QGRR

OPENSUSE-SU-2026:10569-1

Affected Products

Rails

Red Os

Rails-Html-Sanitizer

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53987.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53987.yml · Exploit
• https://github.com/rails/rails-html-sanitizer/commit/f02ffbb8465e73920b6de0da940f5530f855965e · Patch
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-2x5m-9ch4-qgrr · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04577 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53987 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10569-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53987 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53987 · Security Note
• https://ubuntu.com/security/CVE-2024-53987 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2x5m-9ch4-qgrr · Vendor Advisory
• https://github.com/rails/rails-html-sanitizer · Note
• https://suse.com/security/cve/CVE-2024-53988 · Note
• https://redos.red-soft.ru/support/secure · Note