CVE-2026-128068: 
Ruby Analyse et atténuation de la vulnérabilité

CVE-2026-128068 is a Regular Expression Denial of Service (ReDoS) vulnerability in the rails-html-sanitizer gem, which is responsible for sanitizing HTML fragments in Rails applications. The flaw exists in Rails::HTML::PermitScrubber, which validates SVG href and xlink:href attributes using the regex /^\s*[^#\s].*/m — a pattern that causes quadratic CPU consumption when processing all-whitespace attribute values on affected Ruby runtimes. It affects versions >= 1.0.3 and < 1.7.2 of rails-html-sanitizer, and was published on November 13, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is an inefficient regular expression (CWE-1333 / CWE-400) in PermitScrubber#scrub_attribute. The pattern /^\s*[^#\s].*/m uses Ruby's ^ anchor, which matches at the start of every line (not just the string start), combined with \s which matches newlines. When an attacker supplies an SVG href or xlink:href attribute value consisting entirely of whitespace characters (including newlines), the regex engine rescans the entire whitespace run from each line start, resulting in O(n²) time complexity. A 20 KB all-whitespace attribute value was observed to take approximately 3.4 seconds to process on Ruby 3.1.7. This issue only affects CRuby 3.1 and earlier, and JRuby; CRuby 3.2 introduced linear-time regexp matching that eliminates the quadratic behavior. The fix (commit f776f96) replaces the custom regex check with calls to Loofah::HTML5::Scrub.scrub_attribute_value, delegating attribute validation to Loofah >= 2.25.3 (Github Advisory, Patch Commit).

Successful exploitation causes excessive CPU consumption on the server processing the sanitization request, leading to degraded performance or denial of service for other users. The impact is limited to availability (no confidentiality or integrity loss), and only affects applications that have explicitly overridden the default allowed tags to include SVG reference elements such as use, along with href or xlink:href in the allowed attributes list. The default configuration is not affected. Applications using Loofah directly are also exposed through its own copy of the vulnerable check, addressed separately in Loofah 2.25.3 (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires no authentication and no user interaction, but is conditional on the target application having a non-default configuration that explicitly permits SVG reference elements and their href/xlink:href attributes (Github Advisory).

1. Identify target: Locate a Rails application running rails-html-sanitizer >= 1.0.3 and < 1.7.2 on CRuby 3.1 or earlier (or JRuby), where the sanitizer is configured to allow SVG reference elements such as use and permits href or xlink:href attributes.
2. Craft malicious payload: Construct an HTML snippet containing an SVG use element with an href or xlink:href attribute whose value is a long string of whitespace characters (e.g., spaces and newlines), such as: <svg><use href=" + \n * 20000 + "></use></svg>.
3. Submit payload: Send the crafted HTML to any application endpoint that passes user-supplied HTML through the rails-html-sanitizer sanitizer (e.g., a form field, comment box, or API endpoint accepting HTML content).
4. Trigger ReDoS: The sanitizer's PermitScrubber#scrub_attribute method evaluates the regex /^\s*[^#\s].*/m against the whitespace-only value, causing the Ruby regex engine to perform O(n²) backtracking and consuming significant CPU time, potentially hanging the sanitizer thread and degrading server responsiveness (Github Advisory, Patch Commit).

• Network: Repeated HTTP requests to endpoints that accept and sanitize user-supplied HTML, particularly with unusually large href or xlink:href attribute values in SVG elements embedded in request bodies.
• Logs: Application logs showing abnormally long response times or timeouts for requests involving HTML sanitization; Ruby process CPU spikes correlated with specific requests containing SVG markup.
• Process: Sustained high CPU utilization by the Ruby/Rails worker process without a corresponding increase in request volume; worker threads appearing stuck or unresponsive during HTML sanitization operations.

The primary remediation is to upgrade rails-html-sanitizer to version 1.7.2, which replaces the vulnerable regex with a call to Loofah::HTML5::Scrub.scrub_attribute_value and requires Loofah >= 2.25.3. Note that version 1.7.2 also requires Ruby >= 3.2. As a workaround without upgrading, applications can remove SVG reference elements (e.g., use) from their custom allowed tags configuration, or upgrade to CRuby 3.2 or later, which uses a linear-time regexp engine that eliminates the quadratic behavior. Applications using the default allowed tag configuration are not affected and require no action (Github Advisory, Release v1.7.2).

The vulnerability was reported by researcher scyoon through the Rails HackerOne program and was fixed by Mike Dalessio (flavorjones). The advisory notes a related flaw in Loofah (GHSA-mf2j-8f84-cc9q), addressed in Loofah 2.25.3, indicating coordinated disclosure across the Rails HTML sanitization ecosystem. No significant broader media coverage or notable community controversy has been observed (Github Advisory).