Rails-html-sanitizer v1.4.4 addresses multiple CVEs

Security Announcements
1

rails-html-sanitizer v1.4.4 has been released. This is a security update which addresses multiple CVEs, and users are recommended to upgrade immediately.

The release notes are reproduced below, for more information please read the linked GHSAs.

1.4.4 / 2022-12-13

  • Address inefficient regular expression complexity with certain configurations of Rails::Html::Sanitizer.Fixes CVE-2022-23517. See GHSA-5x79-w82f-gw8w for more information.
  • Address improper sanitization of data URIs.Fixes CVE-2022-23518 and #135. See GHSA-mcvf-2q2m-x72m for more information.
  • Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.Fixes CVE-2022-23520. See GHSA-rrfc-7g8p-99q8 for more information.
  • Address possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.Fixes CVE-2022-23519. See GHSA-9h9g-93gc-623h for more information.
1 Like