rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a     possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with     Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may     allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has     overridden the sanitizer's allowed tags where the math, mtext, table, and style elements are     allowed and either either mglyph or malignmark are allowed. This vulnerability is fixed in 1.6.1.
    (CVE-2024-53988)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a
    possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used with
    Rails >= 7.1.0. A possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer may
    allow an attacker to inject content if HTML5 sanitization is enabled and the application developer has
    overridden the sanitizer's allowed tags where the "math", "mtext", "table", and "style" elements are
    allowed and either either "mglyph" or "malignmark" are allowed. This vulnerability is fixed in 1.6.1.
    (CVE-2024-53988)

ID	Name	Product	Family	Severity
253090	Linux Distros Unpatched Vulnerability : CVE-2024-53988	Nessus	Misc.	low
413864	SCA: security update for rails-html-sanitizer (GHSA-cfjx-w229-hgx5)	Tenable Cloud Security	SCA Checks	low
413864	SCA: security update for rails-html-sanitizer (GHSA-cfjx-w229-hgx5)	Tenable Self-Hosted Container Security	SCA Checks	low

Detections

Analytics

CVE-2024-53988

low

Tenable Plugins

low

low

low