PT-2024-36000 · Rails+2 · Rails+2

Mokusou + 2 · Published 2024-12-02 · Updated 2026-04-17 · CVE-2024-53988

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0

Description: There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer when used with Rails >= 7.1.0. This issue may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either "mglyph" or "malignmark" are allowed.

Recommendations: For rails-html-sanitizer version 1.6.0, upgrade to version 1.6.1 to fix the vulnerability. Alternatively, remove "mglyph" and "malignmark" from the overridden allowed tags or downgrade sanitization to HTML4.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-04576

CVE-2024-53988

GHSA-CFJX-W229-HGX5

OPENSUSE-SU-2026:10569-1

Affected Products

Rails

Red Os

Rails-Html-Sanitizer

References · 24

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53988.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53988.yml · Exploit
• https://github.com/rails/rails-html-sanitizer/commit/a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72 · Patch
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cfjx-w229-hgx5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10569-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53988 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53988 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53988 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04576 · Security Note
• https://osv.dev/vulnerability/GHSA-cfjx-w229-hgx5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53988 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53988 · Vendor Advisory
• https://github.com/rails/rails-html-sanitizer · Note
• https://suse.com/security/cve/CVE-2024-53988 · Note
• https://redos.red-soft.ru/support/secure · Note