--- title: GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL... description: The Sanitize Ruby gem's CSS property and URL allowlists can be bypassed using CSS nesting. Browsers that support CSS Nesting parse stylesheets differently than... canonical: https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets | daily.dev og:description: The Sanitize Ruby gem's CSS property and URL allowlists can be bypassed using CSS nesting. Browsers that support CSS Nesting parse stylesheets differently than... og:url: https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg og:image: https://api.daily.dev/og/posts/7i25wAGSg.png og:image:alt: GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets **[RUBYLAND](https://daily.dev/sources/rubyla)** · 1 min read · 0 upvotes · 0 comments ## Summary The Sanitize Ruby gem's CSS property and URL allowlists can be bypassed using CSS nesting. Browsers that support CSS Nesting parse stylesheets differently than Sanitize does, letting an attacker smuggle disallowed declarations past the filter. This lets an attacker apply arbitrary CSS to page elements for UI redressing, or load blocked URLs, which combined with attribute selectors can exfiltrate form input values. No script execution is possible. Unaffected versions are below 3.0.0; 7.0.1 and later are patched. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can CSS nesting bypass the Sanitize gem's CSS property allowlist in Ruby? Sanitize doesn't parse stylesheets the way browsers with CSS Nesting support do, so an attacker can smuggle disallowed CSS declarations past its property and URL protocol allowlists. This lets an attacker apply arbitrary properties for UI redressing or load blocked URLs, and combined with attribute selectors, exfiltrate form input values. No script execution occurs. _Teams sanitizing user HTML track advisories like this Sanitize CSS bypass on daily.dev before shipping a patch._ ### Which versions of the Sanitize Ruby gem are vulnerable to the CSS nesting allowlist bypass and what version fixes it? Versions from 3.0.0 onward are affected by the CSS nesting allowlist bypass (GHSA-wgw9-qhqg-8hv5). The issue is patched in version 7.0.1 and later, so upgrading to 7.0.1 or above resolves the vulnerability. _Developers patching dependency vulnerabilities can follow advisories like this one on daily.dev._ ## Similar posts on daily.dev - [GHSA-pq4g-8rxf-4g29 \(crass\): Incorrect tokenization of bad URLs enables CSS sanitizer bypass](https://daily.dev/posts/ghsa-pq4g-8rxf-4g29-crass-incorrect-tokenization-of-bad-urls-enables-css-sanitizer-bypass-cgxtoi840) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-cj75-f6xr-r4g7 \(rails-html-sanitizer\): Possible XSS vulnerability with certain configurations of rails-html-sanitizer](https://daily.dev/posts/ghsa-cj75-f6xr-r4g7-rails-html-sanitizer-possible-xss-vulnerability-with-certain-configurations-o-9lq3cmn5j) · RUBYLAND · 1 upvotes · 0 comments - [The woes of sanitizing SVGs](https://daily.dev/posts/the-woes-of-sanitizing-svgs-pwfqj7jvs) · Hacker News · 1 upvotes · 0 comments - [GHSA-w67g-2h6v-vjgq \(phlex\): Phlex XSS protection bypass via attribute splatting, dynamic tags, and href values](https://daily.dev/posts/ghsa-w67g-2h6v-vjgq-phlex-phlex-xss-protection-bypass-via-attribute-splatting-dynamic-tags-and--pzcq0uib7) · RUBYLAND · 0 upvotes · 0 comments - [GitHub - sghani001/rails-css\_unused](https://daily.dev/posts/github---sghani001-rails-css-unused-y6oaiwxre) · Ruby Flow · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#css](https://daily.dev/tags/css), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets","url":"https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg"},"datePublished":"2026-10-26T22:23:27.327Z","dateModified":"2026-10-26T22:33:41.516Z","description":"The Sanitize Ruby gem's CSS property and URL allowlists can be bypassed using CSS nesting. Browsers that support CSS Nesting parse stylesheets differently than...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,css,ruby","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-wgw9-qhqg-8hv5 (sanitize): CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-wgw9-qhqg-8hv5-sanitize-css-property-and-url-allowlists-can-be-bypassed-via-css-nesting-in-s-7i25wagsg#faq","mainEntity":[{"@type":"Question","name":"How can CSS nesting bypass the Sanitize gem's CSS property allowlist in Ruby?","acceptedAnswer":{"@type":"Answer","text":"Sanitize doesn't parse stylesheets the way browsers with CSS Nesting support do, so an attacker can smuggle disallowed CSS declarations past its property and URL protocol allowlists. This lets an attacker apply arbitrary properties for UI redressing or load blocked URLs, and combined with attribute selectors, exfiltrate form input values. No script execution occurs. Teams sanitizing user HTML track advisories like this Sanitize CSS bypass on daily.dev before shipping a patch."}},{"@type":"Question","name":"Which versions of the Sanitize Ruby gem are vulnerable to the CSS nesting allowlist bypass and what version fixes it?","acceptedAnswer":{"@type":"Answer","text":"Versions from 3.0.0 onward are affected by the CSS nesting allowlist bypass (GHSA-wgw9-qhqg-8hv5). The issue is patched in version 7.0.1 and later, so upgrading to 7.0.1 or above resolves the vulnerability. Developers patching dependency vulnerabilities can follow advisories like this one on daily.dev."}}]} ```