Rails Sanitizer Flaw Enables Remote XSS
A cross-site scripting vulnerability in Ruby on Rails versions before 1.7.1 lets attackers inject malicious code under certain sanitizer configurations.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
ANSSI (CERT-FR) issued an advisory for a cross-site scripting (XSS) vulnerability affecting Ruby on Rails versions prior to 1.7.1. The flaw resides in the rails-html-sanitizer component and allows an attacker to perform indirect remote code injection under specific configurations, potentially leading to script execution in the context of a victim's browser session.
No evidence of active exploitation is mentioned in the advisory. Administrators are advised to consult the official Ruby on Rails security bulletin (GHSA-cj75-f6xr-r4g7) and apply available patches to remediate the vulnerability.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0891
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs