GHSA-cpgf-5mjf-73p7

Source

https://github.com/advisories/GHSA-cpgf-5mjf-73p7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cpgf-5mjf-73p7

Aliases

CVE-2026-128068

Published

2026-11-13T17:54:38Z

Modified

2026-11-13T18:00:04Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

rails-html-sanitizer: Possible regular expression denial of service with certain configurations

Details

Summary

Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.

Versions affected: >= 1.0.3, < 1.7.2
Not affected: < 1.0.3
Fixed versions: 1.7.2

Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.

Impact

An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.

Applications are affected only when the allowed tags are overridden to include an SVG reference element such as use, along with href or xlink:href in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3.

Workarounds

Run Ruby 3.2 or later, which matches the pattern in linear time, or remove the SVG reference elements from the overridden allowed tags.

Credit

Reported by scyoon through the Rails HackerOne program.

Database specific

{
    "cwe_ids": [
        "CWE-1333",
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-11-13T17:54:38Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

RubyGems / rails-html-sanitizer

Package

Name: rails-html-sanitizer
Purl: pkg:gem/rails-html-sanitizer

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.0.3

Fixed

1.7.2

Affected versions

1.*

1.0.3

1.0.4

1.1.0

1.2.0

1.3.0

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.5.0

1.6.0.rc1

1.6.0.rc2

1.6.0

1.6.1

1.6.2

1.7.0

1.7.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-cpgf-5mjf-73p7/GHSA-cpgf-5mjf-73p7.json"