rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until     1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when     they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-     default allowed tags that included SVG use or feImage elements could therefore permit external references;
    a same-origin external SVG referenced by use could execute scripts in the sanitized document's context,     while feImage could load external images for tracking. Applications using the default allowed tags are not     affected. This issue is fixed in version 1.7.1. (CVE-2026-73648)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until
    1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when
    they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-
    default allowed tags that included SVG use or feImage elements could therefore permit external references;
    a same-origin external SVG referenced by use could execute scripts in the sanitized document's context,
    while feImage could load external images for tracking. Applications using the default allowed tags are not
    affected. This issue is fixed in version 1.7.1. (CVE-2026-73648)

ID	Name	Product	Family	Type	Severity
335355	Linux Distros Unpatched Vulnerability : CVE-2026-73648	Nessus	Misc.	Local	medium
445033	SCA: security update for rails-html-sanitizer (GHSA-cj75-f6xr-r4g7)	Tenable Cloud Security	SCA Checks	Local	medium
445033	SCA: security update for rails-html-sanitizer (GHSA-cj75-f6xr-r4g7)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-73648

medium

Tenable Plugins

medium

medium

medium