CVE-2015-7580
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
CVE-2015-7580- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
CVE-2015-7580- Updated
- 2026-11-02
EUVDEUVD-2017-0239 No score
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
EUVD-2017-0239- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ghqm-pgxj-37gq
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
GHSA-ghqm-pgxj-37gq- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
CVE-2015-7580- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-7580
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
DEBIAN-CVE-2015-7580- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-ghqm-pgxj-37gq
rails-html-sanitizer Cross-site Scripting vulnerability
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
GHSA-ghqm-pgxj-37gq- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7580
Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.
- Record
UBUNTU-CVE-2015-7580- CVSS 3.0
- 6.1 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10189-1 No score
ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 on GA media
These are all security issues fixed in the ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10189-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11349-1 No score
ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11349-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12145-1 No score
ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12145-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13137-1 No score
ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13137-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14175-1 No score
ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14175-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15125-1 No score
ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15125-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10361-1 No score
ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10361-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0391-1 No score
Security update for rubygem-rails-html-sanitizer
This update for rubygem-rails-html-sanitizer fixes the following issues:
- CVE-2015-7579: XSS vulnerability in rails-html-sanitizer (bsc#963327)
- CVE-2015-7578: XSS vulnerability via attributes (bsc#963326)
- CVE-2015-7580: XSS via whitelist sanitizer (bsc#963328)
- Record
SUSE-SU-2016:0391-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1146-1 No score
Security update for portus
Portus was updated to version 2.0.3, which brings several fixes and enhancements:
- Fixed crono job when a repository could not be found.
- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
- Handle multiple scopes in token requests.
- Add optional fields to token response.
- Fixed notification events for Distribution v2.3.
- Paginate through the catalog properly.
- Do not remove all the repositories if fetching one fails.
- Fixed SMTP setup.
- Don't let crono overflow the 'log' column on the DB.
- Show the actual LDAP error on invalid login.
- Fixed the location of crono logs.
- Always use relative paths.
- Set RUBYLIB when using portusctl.
- Don't count hidden teams on the admin panel.
- Warn developers on unsupported docker-compose versions.
- Directly invalidate LDAP logins without name and password.
- Don't show the 'I forgot my password' link on LDAP.
The following Rubygems bundled within Portus have been updated to fix security issues:
- CVE-2016-2098: rubygem-actionpack (bsc#969943).
- CVE-2015-7578: rails-html-sanitizer (bsc#963326).
- CVE-2015-7579: rails-html-sanitizer (bsc#963327).
- CVE-2015-7580: rails-html-sanitizer (bsc#963328).
- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
- CVE-2015-7577: rubygem-activerecord (bsc#963604).
- CVE-2016-0751: rugygem-actionpack (bsc#963627).
- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
- CVE-2015-7581: rubygem-actionpack (bsc#963625).
- Record
SUSE-SU-2016:1146-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rails-html-sanitizerRubyGems |
before 1.0.3 | 1.0.3 |
ruby-rails-html-sanitizerDebian:12 |
before 1.0.3-1 | 1.0.3-1 |
ruby-rails-html-sanitizerDebian:13 |
before 1.0.3-1 | 1.0.3-1 |
ruby-rails-html-sanitizerDebian:14 |
before 1.0.3-1 | 1.0.3-1 |
rails-html-sanitizerRubyGems |
before 1.0.3, plus listed versions 1.0.01.0.11.0.2 |
1.0.3 |
rubygem-rails-html-sanitizerSUSE:Enterprise Storage 2.1 From an advisory covering 3 CVEs |
before 1.0.2-7.1 | 1.0.2-7.1 |
portusSUSE:Linux Enterprise Module for Containers 12 From an advisory covering 10 CVEs |
before 2.0.3-2.4 | 2.0.3-2.4 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.4.3-1.1 | 1.4.3-1.1 |
ruby3.2-rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 1.5.0-2.1 | 1.5.0-2.1 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.5 | 1.6.0-1.5 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.7 | 1.6.0-1.7 |
rubygem-rails-html-sanitizeropenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.6.0-1.9 | 1.6.0-1.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7580 is a medium vulnerability (CVSS 6.1) in Rubyonrails Html Sanitizer, published February 9, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.19%, the 82nd percentile. Fixed in rails-html-sanitizer 1.0.3.
References
groups.google.com/forum/message/raw?msg=rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ
lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
openwall.com/lists/oss-security/2016/01/25/15
securitytracker.com/id/1034816
github.com/rails/rails-html-sanitizer/commit/63903b0eaa6d2a4e1c91bc86008256c4c8335e78
Show 38 moreShow less
nvd.nist.gov/vuln/detail/CVE-2015-7580
web.archive.org/web/20160128075017/http://www.securitytracker.com/id/1034816
security-tracker.debian.org/tracker/CVE-2015-7580
suse.com/support/update/announcement/2016/suse-su-20160391-1
bugzilla.suse.com/963326
ubuntu.com/security/CVE-2015-7580
marc.info?l=oss-security&m=145375090928793&w=2
cve.org/CVERecord?id=CVE-2015-7580