rails-html-sanitizer: Possible regular expression denial of service with certain configurations
CVE-2026-128068
Summary Rails::HTML::PermitScrubber restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s[^#\s]./m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length. Versions affected: >= 1.0.3, < 1.7.2 Not affected: < 1.0.3 Fixed versions: 1.7.2 Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear. Impact An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace. Applications are affected only when the allowed tags are overridden to include an SVG reference element such as use, along with href or xlink:href in the allowed attributes. The default allowed tags include no SVG elements, so the default configuration is not affected. Applications that use Loofah directly are exposed through its own copy of the check, fixed in Loofah 2.25.3. Workarounds Run Ruby 3.2 or later, which…
Assessment
- CVSS
- 5.3 (v3.1)
- Severity
- Medium
- EPSS
- 0% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 13 November 2026
- Last updated
- 13 November 2026
- Affected
- rails · rails-html-sanitizer · rails-html-sanitizer
- Weakness
- CWE-1333, CWE-400
- Assigner
- GitHub_M
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
At the source
References
- https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-cpgf-5mjf-73p7
- https://github.com/rails/rails-html-sanitizer/commit/f776f963b9d9346271aade9cb903e793fd38e865
- https://github.com/rails/rails-html-sanitizer/releases/tag/v1.7.2
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/GHSA-cpgf-5mjf-73p7.yml
- https://github.com/advisories/GHSA-cpgf-5mjf-73p7
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-128068