{"id":"CVE-2022-23519","summary":"Possible XSS vulnerability with certain configurations of rails-html-sanitizer","details":"rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both \"math\" and \"style\" elements,  or allow both \"svg\" and \"style\" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include \"math\" or \"svg\" and \"style\" should either upgrade or use the following workaround immediately: Remove \"style\" from the overridden allowed tags, or remove \"math\" and \"svg\" from the overridden allowed tags.","aliases":["GHSA-9h9g-93gc-623h"],"modified":"2026-03-20T11:53:46.364566Z","published":"2022-12-14T16:50:14.949Z","related":["SUSE-SU-2023:3534-1","SUSE-SU-2023:3714-1","openSUSE-SU-2024:12769-1","openSUSE-SU-2024:14175-1","openSUSE-SU-2025:15125-1","openSUSE-SU-2026:10361-1"],"database_specific":{"cna_assigner":"GitHub_M","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23519.json","cwe_ids":["CWE-79"]},"references":[{"type":"WEB","url":"https://hackerone.com/reports/1656627"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00045.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23519.json"},{"type":"ADVISORY","url":"https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-9h9g-93gc-623h"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23519"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rails/rails-html-sanitizer","events":[{"introduced":"0"},{"fixed":"fd63deaeb22e601237d4d4d12014e7ebd410ea9b"}]}],"versions":["v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.1.0","v1.2.0","v1.3.0","v1.4.0","v1.4.1","v1.4.2","v1.4.3"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23519.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}]}