Bug 2515530 (CVE-2026-73648)

Summary:	CVE-2026-73648 rails-html-sanitizer: rails-html-sanitizer: Cross-Site Scripting vulnerability due to improper SVG sanitization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akostadi, amasferr, anthomas, dmayorov, ehelms, eshamard, ggainey, jlledo, jpasqual, juwatts, jvasik, kaycoth, mdellweg, mhulan, nmoumoul, osousa, pantinor, pcreech, rblanco, rchan, smallamp, tmalecek, tsedmik
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in rails-html-sanitizer, a component responsible for sanitizing HTML fragments in Rails applications. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by exploiting improper sanitization of SVG (Scalable Vector Graphics) reference elements. The Rails::HTML::PermitScrubber component failed to restrict the href attribute in SVG elements, which browsers accept in addition to xlink:href. This oversight could enable an attacker to execute malicious scripts in the context of the sanitized document or load external images for tracking, affecting applications configured with non-default allowed SVG tags.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2520926
Bug Blocks:

Description OSIDB Bzimport 2026-08-13 18:27:14 UTC

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.