CVE-2015-7578
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
CVE-2015-7578- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
CVE-2015-7578- Updated
- 2026-11-02
EUVDEUVD-2017-0169 No score
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
EUVD-2017-0169- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-59c7-4xj2-hgvw
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
GHSA-59c7-4xj2-hgvw- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
CVE-2015-7578- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7578
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
DEBIAN-CVE-2015-7578- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-59c7-4xj2-hgvw
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
GHSA-59c7-4xj2-hgvw- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7578
Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via crafted tag attributes.
- Record
UBUNTU-CVE-2015-7578- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10189-1 No score
ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10189-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11349-1 No score
ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11349-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12145-1 No score
ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12145-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13137-1 No score
ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13137-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14175-1 No score
ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14175-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15125-1 No score
ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15125-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10361-1 No score
ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10361-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0391-1 No score
Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issues:
- CVE-2015-7579: XSS vulnerability in rails-html-sanitizer (bsc#963327)
- CVE-2015-7578: XSS vulnerability via attributes (bsc#963326)
- CVE-2015-7580: XSS via whitelist sanitizer (bsc#963328)
- Record
SUSE-SU-2016:0391-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1146-1 No score
Security update for portus
Portus was updated to version 2.0.3, which brings several fixes and enhancements:
- Fixed crono job when a repository could not be found.
- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
- Handle multiple scopes in token requests.
- Add optional fields to token response.
- Fixed notification events for Distribution v2.3.
- Paginate through the catalog properly.
- Do not remove all the repositories if fetching one fails.
- Fixed SMTP setup.
- Don't let crono overflow the 'log' column on the DB.
- Show the actual LDAP error on invalid login.
- Fixed the location of crono logs.
- Always use relative paths.
- Set RUBYLIB when using portusctl.
- Don't count hidden teams on the admin panel.
- Warn developers on unsupported docker-compose versions.
- Directly invalidate LDAP logins without name and password.
- Don't show the 'I forgot my password' link on LDAP.
The following Rubygems bundled within Portus have been updated to fix security issues:
- CVE-2016-2098: rubygem-actionpack (bsc#969943).
- CVE-2015-7578: rails-html-sanitizer (bsc#963326).
- CVE-2015-7579: rails-html-sanitizer (bsc#963327).
- CVE-2015-7580: rails-html-sanitizer (bsc#963328).
- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
- CVE-2015-7577: rubygem-activerecord (bsc#963604).
- CVE-2016-0751: rugygem-actionpack (bsc#963627).
- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
- CVE-2015-7581: rubygem-actionpack (bsc#963625).
- Record
SUSE-SU-2016:1146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rails-html-sanitizerRubyGems |
before 1.0.3 | 1.0.3 |
ruby-rails-html-sanitizerDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
ruby-rails-html-sanitizerDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
ruby-rails-html-sanitizerDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
rails-html-sanitizerRubyGems |
before 1.0.3, plus listed versions 1.0.01.0.11.0.2 |
1.0.3 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 2.1 From an advisory covering 3 CVEs |
before 1.0.2-7.1 | 1.0.2-7.1 |
portusSUSE:Linux Enterprise Module for Containers 12 From an advisory covering 10 CVEs |
before 2.0.3-2.4 | 2.0.3-2.4 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.4.3-1.1 | 1.4.3-1.1 |
ruby3.2-rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.5.0-2.1 | 1.5.0-2.1 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.5 | 1.6.0-1.5 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.7 | 1.6.0-1.7 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.9 | 1.6.0-1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7578 is a medium vulnerability (CVSS 6.1) in Rubyonrails Html Sanitizer, published February 9, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.48%, the 84th percentile. Fixed in rails-html-sanitizer 1.0.3.
References
lists.fedoraproject.org/pipermail/package-announce/2016-February/178046.html
openwall.com/lists/oss-security/2016/01/25/11
lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
github.com/rails/rails-html-sanitizer/commit/297161e29a3e11186ce4c02bf7defc088bf544d4
securitytracker.com/id/1034816
groups.google.com/forum/message/raw?msg=ruby-security-ann/uh--W4TDwmI/ygHE7hlZEgAJ
Show 40 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-7578
web.archive.org/web/20160128075017/http://www.securitytracker.com/id/1034816
security-tracker.debian.org/tracker/CVE-2015-7578
suse.com/support/update/announcement/2016/suse-su-20160391-1
bugzilla.suse.com/963326
ubuntu.com/security/CVE-2015-7578
marc.info?l=oss-security&m=145375052028672&w=2
cve.org/CVERecord?id=CVE-2015-7578