{"id":"CVE-2020-4054","aliases":["DEBIAN-CVE-2020-4054","DSA-4730-1","EUVD-2020-0503","GHSA-p4x4-rw2p-8j8m","UBUNTU-CVE-2020-4054","USN-4543-1"],"status":"published","title":"Cross-site Scripting in Sanitize","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01917,"percentile":0.80024,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-06-16T22:08:06Z","modified":"2026-10-26T12:02:50Z","fixes":[{"ecosystem":"RubyGems","package":"sanitize","fixed_in":["5.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-sanitize","fixed_in":["4.6.6-2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-sanitize","fixed_in":["4.6.6-2.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-sanitize","fixed_in":["4.6.6-2.1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"ruby-sanitize","fixed_in":["4.6.6-2.1~deb10u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ruby-sanitize","fixed_in":["4.6.6-2.1~0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1~deb10u1"}]}],"versions":["4.6.6-2"]},{"source":"osv","ecosystem":"RubyGems","package":"sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.2.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","4.0.0","4.0.1","4.1.0","4.2.0","4.3.0","4.4.0","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","5.0.0","5.1.0","5.2.0"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1","2.1.0-2","2.1.0-2+deb9u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-2","2.1.0-2+deb9u1build0.18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1~0.20.04.1"}]}],"versions":["4.6.6-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-sanitize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.6-2.1~0.20.04.1"}]}],"versions":["4.6.6-2"]}],"products":[{"vendor":"rgrove","product":"sanitize"},{"vendor":"sanitize_project","product":"sanitize"}],"references":[{"url":"https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/rgrove/sanitize/releases/tag/v5.2.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web","report"]},{"url":"https://www.debian.org/security/2020/dsa-4730","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://usn.ubuntu.com/4543-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4054","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2020-4054.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p4x4-rw2p-8j8m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-4054","tags":["advisory"]},{"url":"https://github.com/rgrove/sanitize","tags":["package"]},{"url":"https://usn.ubuntu.com/4543-1","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-4054","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4543-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-4054","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-4054","title":"Cross-site Scripting in Sanitize","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:10:13Z","modified":"2024-08-04T07:52:20.925Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-0503","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:10:13Z","modified":"2024-08-04T07:52:20Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T03:08:08.458165Z"}],"ghsa":[{"id":"GHSA-p4x4-rw2p-8j8m","title":"Cross-site Scripting in Sanitize ","description":"When HTML is sanitized using Sanitize's \"relaxed\" config or a custom config that allows certain elements, some content in a `\u003cmath\u003e` or `\u003csvg\u003e` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.\n\nYou are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:\n\n- `iframe`\n- `math`\n- `noembed`\n- `noframes`\n- `noscript`\n- `plaintext`\n- `script`\n- `style`\n- `svg`\n- `xmp`\n\n### Impact\n\nUsing carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.\n\n### Releases\n\nThis problem has been fixed in Sanitize 5.2.1.\n\n### Workarounds\n\nIf upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:\n\n```ruby\n%w[iframe math noembed noframes noscript plaintext script style svg xmp]\n```\n\nFor example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:\n\n```ruby\ncustom_config = Sanitize::Config.merge(\n  Sanitize::Config::RELAXED,\n  :remove_contents =\u003e %w[iframe math noembed noframes noscript plaintext script style svg xmp]\n)\n```\n\nYou would then pass this custom config to Sanitize when sanitizing HTML.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).\n- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).\n\n### Credits\n\nMany thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.\n\n### References\n\n- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)\n- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)\n- https://github.com/rgrove/sanitize/releases/tag/v5.2.1","status":"published","published":"2020-06-16T22:08:06Z","modified":"2023-05-16T16:18:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2020-4054","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:15:10.693Z","modified":"2026-06-17T03:19:30.063Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:07.249892Z"}],"osv":[{"id":"CVE-2020-4054","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:15:10.693Z","modified":"2026-10-20T10:53:28.180798875Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:16.936975Z"},{"id":"DEBIAN-CVE-2020-4054","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:15:10.693Z","modified":"2026-10-26T12:02:50.191097998Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-p4x4-rw2p-8j8m","title":"Cross-site Scripting in Sanitize ","description":"When HTML is sanitized using Sanitize's \"relaxed\" config or a custom config that allows certain elements, some content in a `\u003cmath\u003e` or `\u003csvg\u003e` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.\n\nYou are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:\n\n- `iframe`\n- `math`\n- `noembed`\n- `noframes`\n- `noscript`\n- `plaintext`\n- `script`\n- `style`\n- `svg`\n- `xmp`\n\n### Impact\n\nUsing carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.\n\n### Releases\n\nThis problem has been fixed in Sanitize 5.2.1.\n\n### Workarounds\n\nIf upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:\n\n```ruby\n%w[iframe math noembed noframes noscript plaintext script style svg xmp]\n```\n\nFor example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:\n\n```ruby\ncustom_config = Sanitize::Config.merge(\n  Sanitize::Config::RELAXED,\n  :remove_contents =\u003e %w[iframe math noembed noframes noscript plaintext script style svg xmp]\n)\n```\n\nYou would then pass this custom config to Sanitize when sanitizing HTML.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).\n- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).\n\n### Credits\n\nMany thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.\n\n### References\n\n- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)\n- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)\n- https://github.com/rgrove/sanitize/releases/tag/v5.2.1","status":"published","published":"2020-06-16T22:08:06Z","modified":"2026-07-08T06:29:13.144817987Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"UBUNTU-CVE-2020-4054","description":"In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's \"relaxed\" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.","status":"published","published":"2020-06-16T22:15:00Z","modified":"2026-02-04T03:56:54.94038Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:54:25.179924Z"},{"id":"DSA-4730-1","title":"ruby-sanitize - security update","status":"published","published":"2020-07-19T00:00:00Z","modified":"2026-03-09T02:10:40.584376Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4543-1","title":"ruby-sanitize vulnerability","description":"Michał Bentkowski discovered that Sanitize did not properly sanitize some\nmath or svg HTML under certain circumstances. A remote attacker could\npotentially exploit this to conduct cross-site scripting (XSS) attacks.\n(CVE-2020-4054)\n","status":"published","published":"2020-09-25T17:03:04Z","modified":"2026-04-27T15:43:24.795318Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}