rails-html-sanitizer CVE-2026-73648

Exploitation requires the application to have explicitly overridden the default rails-html-sanitizer allowed-tag list to include at least one SVG reference element - specifically 'use' or 'feImage'. Applications using the default allowed-tag configuration are confirmed not affected. For XSS via script execution, the externally referenced SVG document must be same-origin with the sanitized document; cross-origin SVG references are blocked by browser same-origin policy and do not enable script execution. The 'feImage' path enables cross-origin image loading for tracking purposes only, not script execution. User interaction is required (CVSS UI:A): a victim must load or view the page containing the sanitized, attacker-controlled content. There is no authentication requirement on the attacker side (PR:N), but the attacker must have the ability to submit content that passes through the sanitizer - typically requiring an account or some form of content submission access on the target application.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, score 5.1) correctly reflects the moderate real-world risk: network-reachable with no special attack complexity, but user interaction is required and downstream system impact is limited to low confidentiality and low integrity changes (SC:L/SI:L). The single most significant limiting factor is that the vulnerability is only reachable when an application has explicitly overridden the default allowed-tag list to include SVG reference elements - a non-default, deliberate configuration choice. Applications on the default configuration are confirmed unaffected. There is no CISA KEV listing and no public exploit code identified, placing this in a low-urgency category for most operators. The EPSS signal is not provided in the input data and cannot be inferred. The most realistic harm is XSS via a same-origin SVG chained with existing attacker-controlled content, or pixel-tracking via feImage - neither a trivial nor a catastrophic outcome. A mid-sized development team running a Rails application with a custom rich-text or SVG-rendering feature should audit their PermitScrubber tag configuration before concluding they are unaffected, but the combination of non-default prerequisite, UI dependency, and absence of active exploitation means this is not a drop-everything emergency for the broad Rails ecosystem.

An attacker submits user-generated content containing an SVG 'use' element with a plain 'href' pointing to a same-origin SVG file that includes a script payload. The sanitizer, misconfigured to allow 'use' and 'href', passes the element through intact. When a victim user views the sanitized content in their browser, the SVG 'use' reference is resolved, the external same-origin SVG is fetched and rendered, and its embedded script executes in the context of the sanitized document - enabling session theft, DOM manipulation, or credential harvesting. No public proof-of-concept code has been identified at time of analysis.