rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a     possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with     Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain     configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is     enabled and the application developer has overridden the sanitizer's allowed tags with both math and     style elements or both both svg and style elements. This vulnerability is fixed in 1.6.1.
    (CVE-2024-53985)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a
    possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with
    Rails >= 7.1.0 and Nokogiri < 1.15.7, or 1.16.x < 1.16.8. The XSS vulnerability with certain
    configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is
    enabled and the application developer has overridden the sanitizer's allowed tags with both "math" and
    "style" elements or both both "svg" and "style" elements. This vulnerability is fixed in 1.6.1.
    (CVE-2024-53985)

ID	Name	Product	Family	Type	Severity
253094	Linux Distros Unpatched Vulnerability : CVE-2024-53985	Nessus	Misc.	Local	low
419813	SCA: security update for rails-html-sanitizer (GHSA-w8gc-x259-rc7x)	Tenable Cloud Security	SCA Checks	Local	low
419813	SCA: security update for rails-html-sanitizer (GHSA-w8gc-x259-rc7x)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2024-53985

low

Tenable Plugins

low

low

low