Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:gem/rails-html-sanitizer@1.1
purl pkg:gem/rails-html-sanitizer@1.1
Tags Ghost
Next non-vulnerable version 1.6.1
Latest non-vulnerable version 1.6.1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ujza-s7ug-9fcp
Aliases:
CVE-2015-7579
GHSA-r9c2-cr39-c8g6
XSS vulnerability in strip_tags Due to the way that `Rails::Html::FullSanitizer` is implemented, if an attacker passes an already escaped HTML entity to the input of Action View's `strip_tags` these entities will be unescaped what may cause a XSS attack if used in combination with `raw` or `html_safe`. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T15:18:26.103962+00:00 Ruby Importer Affected by VCID-ujza-s7ug-9fcp https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2015-7579.yml 38.0.0