PT-2024-36001 · Unknown+2 · Rails-Html-Sanitizer+2

Mokusou + 2 · CVE-2024-53989 · Published 2024-12-02 · Updated 2026-04-17

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer versions 1.6.0

Description: The issue is related to a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer when used with Rails >= 7.1.0. This vulnerability may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags for the "noscript" element.

Recommendations: For rails-html-sanitizer version 1.6.0, upgrade to version 1.6.1 to fix the vulnerability. As a temporary workaround, consider removing "noscript" from the overridden allowed tags or downgrading sanitization to HTML4.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-04580

CVE-2024-53989

GHSA-RXV5-GXQC-XX8G

OPENSUSE-SU-2026:10569-1

Affected Products

Rails

Red Os

Rails-Html-Sanitizer

References · 25

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53989.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2024-53989.yml · Exploit
• https://github.com/rails/rails-html-sanitizer/commit/16251735e36ebdc302e2f90f2a39cad56879414f · Patch
• https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-rxv5-gxqc-xx8g · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxv5-gxqc-xx8g · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53989 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-53989 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10569-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53989 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-04580 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53989 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53989 · Vendor Advisory
• https://github.com/rails/rails-html-sanitizer · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/CVEnew/status/1863693118458994829 · Twitter Post