{"id":"CVE-2015-7580","aliases":["DEBIAN-CVE-2015-7580","EUVD-2017-0239","GHSA-ghqm-pgxj-37gq","SUSE-SU-2016:0391-1","SUSE-SU-2016:1146-1","UBUNTU-CVE-2015-7580","openSUSE-SU-2024:10189-1","openSUSE-SU-2024:11349-1","openSUSE-SU-2024:12145-1","openSUSE-SU-2024:13137-1","openSUSE-SU-2024:14175-1","openSUSE-SU-2025:15125-1","openSUSE-SU-2026:10361-1"],"status":"published","title":"rails-html-sanitizer Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","severity":{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02188,"percentile":0.82527,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-02-09T10:02:32Z","modified":"2026-09-09T07:01:50Z","fixes":[{"ecosystem":"RubyGems","package":"rails-html-sanitizer","fixed_in":["1.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-rails-html-sanitizer","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-rails-html-sanitizer","fixed_in":["1.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-rails-html-sanitizer","fixed_in":["1.0.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}],"versions":["1.0.0","1.0.1","1.0.2"]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 2.1","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"portus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.4"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-2.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.5"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.7"}]}],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1.9"}]}],"bundled":9}],"products":[{"vendor":"rubyonrails","product":"html_sanitizer"}],"references":[{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/uh--W4TDwmI/m_CVZtdbFQAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/25/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1034816","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://github.com/rails/rails-html-sanitizer/commit/63903b0eaa6d2a4e1c91bc86008256c4c8335e78","tags":["x_refsource_CONFIRM","x_transferred","fix","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7580","tags":["advisory"]},{"url":"https://web.archive.org/web/20160128075017/http://www.securitytracker.com/id/1034816","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ghqm-pgxj-37gq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-7580","tags":["advisory"]},{"url":"https://github.com/rails/rails-html-sanitizer","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963326","tags":["report"]},{"url":"https://bugzilla.suse.com/963327","tags":["report"]},{"url":"https://bugzilla.suse.com/963328","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7580","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963563","tags":["report"]},{"url":"https://bugzilla.suse.com/963604","tags":["report"]},{"url":"https://bugzilla.suse.com/963608","tags":["report"]},{"url":"https://bugzilla.suse.com/963617","tags":["report"]},{"url":"https://bugzilla.suse.com/963625","tags":["report"]},{"url":"https://bugzilla.suse.com/963627","tags":["report"]},{"url":"https://bugzilla.suse.com/969943","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2098","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-7580","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=145375090928793\u0026w=2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7580","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23520","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4QQONV4QKIWHRILZMO26H7FGDPO7KJAF/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-7580","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2016-02-16T02:00:00Z","modified":"2024-08-06T07:51:28.598Z","updated_at":"2026-11-02T14:35:44.404481Z"}],"euvd":[{"id":"EUVD-2017-0239","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2016-02-16T02:00:00Z","modified":"2024-08-06T07:51:28Z","updated_at":"2026-11-03T02:21:52.097705Z"}],"ghsa":[{"id":"GHSA-ghqm-pgxj-37gq","title":"rails-html-sanitizer Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in `lib/rails/html/scrubbers.rb` in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-01-23T21:16:06Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:14.033357Z"}],"nvd":[{"id":"CVE-2015-7580","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2016-02-16T02:59:03.97Z","modified":"2026-06-17T00:32:47.363Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-7580","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2016-02-16T02:59:03Z","modified":"2026-03-16T03:09:07.034636Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-7580","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2016-02-16T02:59:03.97Z","modified":"2026-09-09T07:01:50.290602359Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-ghqm-pgxj-37gq","title":"rails-html-sanitizer Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in `lib/rails/html/scrubbers.rb` in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-02-16T08:17:12.479568Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"UBUNTU-CVE-2015-7580","description":"Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inject arbitrary web script or HTML via a crafted CDATA node.","status":"withdrawn","published":"2016-02-16T02:59:00Z","modified":"2025-07-16T07:17:36.855066Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.737723Z"},{"id":"openSUSE-SU-2024:10189-1","title":"ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-rails-html-sanitizer-1.0.3-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:39.888819Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11349-1","title":"ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-rails-html-sanitizer-1.4.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:50:53.845204Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:12145-1","title":"ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-rails-html-sanitizer-1.4.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:52.92798Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"openSUSE-SU-2024:13137-1","title":"ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rails-html-sanitizer-1.5.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:42.840413Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14175-1","title":"ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rails-html-sanitizer-1.6.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:30:17.606646Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15125-1","title":"ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rails-html-sanitizer-1.6.0-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T04:04:42.907486Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10361-1","title":"ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-rails-html-sanitizer-1.6.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:26:09.712889Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2016:0391-1","title":"Security update for rubygem-rails-html-sanitizer","description":"\nThis update for rubygem-rails-html-sanitizer fixes the following issues:\n\n- CVE-2015-7579: XSS vulnerability in rails-html-sanitizer (bsc#963327)\n- CVE-2015-7578: XSS vulnerability via attributes (bsc#963326)\n- CVE-2015-7580: XSS via whitelist sanitizer (bsc#963328)\n","status":"published","published":"2016-02-09T10:02:32Z","modified":"2026-02-04T02:40:30.586863Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:1146-1","title":"Security update for portus","description":"\nPortus was updated to version 2.0.3, which brings several fixes and enhancements:\n\n- Fixed crono job when a repository could not be found.\n- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.\n- Handle multiple scopes in token requests.\n- Add optional fields to token response.\n- Fixed notification events for Distribution v2.3.\n- Paginate through the catalog properly.\n- Do not remove all the repositories if fetching one fails.\n- Fixed SMTP setup.\n- Don't let crono overflow the 'log' column on the DB.\n- Show the actual LDAP error on invalid login.\n- Fixed the location of crono logs.\n- Always use relative paths.\n- Set RUBYLIB when using portusctl.\n- Don't count hidden teams on the admin panel.\n- Warn developers on unsupported docker-compose versions.\n- Directly invalidate LDAP logins without name and password.\n- Don't show the 'I forgot my password' link on LDAP.\n\nThe following Rubygems bundled within Portus have been updated to fix security\nissues:\n\n- CVE-2016-2098: rubygem-actionpack (bsc#969943).\n- CVE-2015-7578: rails-html-sanitizer (bsc#963326).\n- CVE-2015-7579: rails-html-sanitizer (bsc#963327).\n- CVE-2015-7580: rails-html-sanitizer (bsc#963328).\n- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).\n- CVE-2015-7577: rubygem-activerecord (bsc#963604).\n- CVE-2016-0751: rugygem-actionpack (bsc#963627).\n- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).\n- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).\n- CVE-2015-7581: rubygem-actionpack (bsc#963625).\n","status":"published","published":"2016-04-25T14:28:51Z","modified":"2026-02-04T03:47:46.041833Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}