rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or "math" element is not allowed. This vulnerability is fixed in 1.6.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a     possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with     Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may     allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has     overridden the sanitizer's allowed tags where the style element is explicitly allowed and the svg or     math element is not allowed. This vulnerability is fixed in 1.6.1. (CVE-2024-53987)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a
    possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with
    Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may
    allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has
    overridden the sanitizer's allowed tags where the "style" element is explicitly allowed and the "svg" or
    "math" element is not allowed. This vulnerability is fixed in 1.6.1. (CVE-2024-53987)

ID	Name	Product	Family	Severity
253123	Linux Distros Unpatched Vulnerability : CVE-2024-53987	Nessus	Misc.	low
409155	SCA: security update for rails-html-sanitizer (GHSA-2x5m-9ch4-qgrr)	Tenable Cloud Security	SCA Checks	low
409155	SCA: security update for rails-html-sanitizer (GHSA-2x5m-9ch4-qgrr)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2024-53987

low

Tenable Plugins

low

low

low