rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:4445-1 advisory.

    This update for rubygem-rails-html-sanitizer fixes the following issue:

    - CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured     to allow       certain SVG reference elements (bsc#1275199).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until     1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when     they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-     default allowed tags that included SVG use or feImage elements could therefore permit external references;
    a same-origin external SVG referenced by use could execute scripts in the sanitized document's context,     while feImage could load external images for tracking. Applications using the default allowed tags are not     affected. This issue is fixed in version 1.7.1. (CVE-2026-73648)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until
    1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when
    they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-
    default allowed tags that included SVG use or feImage elements could therefore permit external references;
    a same-origin external SVG referenced by use could execute scripts in the sanitized document's context,
    while feImage could load external images for tracking. Applications using the default allowed tags are not
    affected. This issue is fixed in version 1.7.1. (CVE-2026-73648)

ID	Name	Product	Family	Type	Severity
363065	SUSE SLES15 Security Update : rubygem-rails-html-sanitizer (SUSE-SU-2026:4445-1)	Nessus	SuSE Local Security Checks	Local	medium
335355	Linux Distros Unpatched Vulnerability : CVE-2026-73648	Nessus	Misc.	Local	medium
445033	SCA: security update for rails-html-sanitizer (GHSA-cj75-f6xr-r4g7)	Tenable Cloud Security	SCA Checks	Local	medium
445033	SCA: security update for rails-html-sanitizer (GHSA-cj75-f6xr-r4g7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-73648

medium

Tenable Plugins

medium

medium

medium

medium