--- title: GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS... description: A cross-site scripting (XSS) vulnerability (GHSA-cj75-f6xr-r4g7) has been disclosed in the rails-html-sanitizer gem. The vulnerability is triggered when the... canonical: https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with certain configurations of rails-html-sanitizer | daily.dev og:description: A cross-site scripting (XSS) vulnerability (GHSA-cj75-f6xr-r4g7) has been disclosed in the rails-html-sanitizer gem. The vulnerability is triggered when the... og:url: https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j og:image: https://api.daily.dev/og/posts/9lQ3cMN5j.png og:image:alt: GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with certain configurations of rails-html-sanitizer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with certain configurations of rails-html-sanitizer **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 1 upvotes · 0 comments ## Summary A cross-site scripting (XSS) vulnerability (GHSA-cj75-f6xr-r4g7) has been disclosed in the rails-html-sanitizer gem. The vulnerability is triggered when the sanitizer is configured to allow SVG reference elements such as ``. It mirrors a related issue in the Loofah gem (GHSA-9wjq-cp2p-hrgf). Versions below 1.0.3 are unaffected; the patch is available in version 1.7.1 and above. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What version of rails-html-sanitizer fixes the XSS vulnerability with SVG use elements? Version 1.7.1 patches the cross-site scripting vulnerability that occurs when rails-html-sanitizer is configured to allow SVG reference elements such as . The flaw mirrors a related issue in the Loofah gem's SVG local-reference logic, which rails-html-sanitizer's own SVG handling is based on. Applications using custom sanitizer configurations permitting these elements should upgrade to 1.7.1 or later. _Track gem advisories like this one on daily.dev so a sanitizer misconfiguration doesn't slip into production._ ### Is my rails-html-sanitizer setup vulnerable to XSS even if I'm not using custom SVG configurations? No, this vulnerability only applies when the sanitizer is explicitly configured to allow SVG reference elements such as . Default configurations that don't permit SVG elements are not affected by this particular issue. The unaffected range starts before version 1.0.3, and the fix lands in 1.7.1. _Developers auditing sanitizer configs can follow security advisories like this on daily.dev._ ## Similar posts on daily.dev - [GHSA-9wjq-cp2p-hrgf \(loofah\): SVG \`href\` attribute bypasses local-reference restriction in Loofah](https://daily.dev/posts/ghsa-9wjq-cp2p-hrgf-loofah-svg-href-attribute-bypasses-local-reference-restriction-in-loofah-onzax4oq3) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-4249-gjr8-jpq3 \(prosemirror\_to\_html\): ProsemirrorToHtml has a Cross-Site Scripting \(XSS\) vulnerability through unescaped HTML attribute values](https://daily.dev/posts/ghsa-4249-gjr8-jpq3-prosemirror-to-html-prosemirrortohtml-has-a-cross-site-scripting-xss-vulner-fyyo8nbti) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-m5f6-4589-m89f \(blazer\): Stored XSS vulnerability](https://daily.dev/posts/ghsa-m5f6-4589-m89f-blazer-stored-xss-vulnerability-3ifg1cgjx) · RUBYLAND · 0 upvotes · 0 comments - [CVE-2026-55877: XSS in symfony/ux-icons via unsanitized SVG content in local files and Iconify on-demand responses \(Symfony Blog\)](https://daily.dev/posts/cve-2026-55877-xss-in-symfony-ux-icons-via-unsanitized-svg-content-in-local-files-and-iconify-on-de-hrpqqcxja) · Symfony · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby), [#svg](https://daily.dev/tags/svg) [View this post on daily.dev](https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with certain configurations of rails-html-sanitizer","url":"https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j"},"datePublished":"2026-07-17T18:22:55.834Z","dateModified":"2026-09-14T08:20:01.099Z","description":"A cross-site scripting (XSS) vulnerability (GHSA-cj75-f6xr-r4g7) has been disclosed in the rails-html-sanitizer gem. The vulnerability is triggered when the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby,svg","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-cj75-f6xr-r4g7 (rails-html-sanitizer): Possible XSS vulnerability with certain configurations of rails-html-sanitizer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j#faq","mainEntity":[{"@type":"Question","name":"What version of rails-html-sanitizer fixes the XSS vulnerability with SVG use elements?","acceptedAnswer":{"@type":"Answer","text":"Version 1.7.1 patches the cross-site scripting vulnerability that occurs when rails-html-sanitizer is configured to allow SVG reference elements such as . The flaw mirrors a related issue in the Loofah gem's SVG local-reference logic, which rails-html-sanitizer's own SVG handling is based on. Applications using custom sanitizer configurations permitting these elements should upgrade to 1.7.1 or later. Track gem advisories like this one on daily.dev so a sanitizer misconfiguration doesn't slip into production."}},{"@type":"Question","name":"Is my rails-html-sanitizer setup vulnerable to XSS even if I'm not using custom SVG configurations?","acceptedAnswer":{"@type":"Answer","text":"No, this vulnerability only applies when the sanitizer is explicitly configured to allow SVG reference elements such as . Default configurations that don't permit SVG elements are not affected by this particular issue. The unaffected range starts before version 1.0.3, and the fix lands in 1.7.1. Developers auditing sanitizer configs can follow security advisories like this on daily.dev."}}]} ```