XSS in Rgrove Sanitize
CVE-2020-4054
In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.019 (77.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
Affected products
- Rgrove Sanitize — versions >= 3.0.0, < 5.2.1
- Sanitize_project Sanitize
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Release Notes)
- security-advisories@github.com (vendor-advisory, x_refsource_DEBIAN)
- security-advisories@github.com (x_refsource_UBUNTU, vendor-advisory)
Frequently asked questions
- What is CVE-2020-4054?
- CVE-2020-4054 is a high-severity vulnerability in Rgrove Sanitize, classified under Cross-site Scripting. CVSS score: 7.3/10. Published 2020-06-16.
- How severe is CVE-2020-4054?
- High severity. CVSS v3 base score is 7.3 out of 10.
- Is CVE-2020-4054 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.