CVE-2026-73648: 
Ruby vulnerability analysis and mitigation

CVE-2026-73648 is a cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem, which is responsible for sanitizing HTML fragments in Rails applications. The flaw exists in versions >= 1.0.3 and < 1.7.1, where Rails::HTML::PermitScrubber failed to restrict the plain href attribute on SVG reference elements (such as <use> and <feImage>), only blocking the legacy xlink:href attribute. Applications that override the default allowed tags to include these SVG elements are affected; those using the default configuration are not. It was disclosed on July 16, 2026, and fixed in version 1.7.1. The CVSS v4.0 base score is 5.1 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting). Rails::HTML::PermitScrubber reimplemented Loofah's SVG local-reference restriction logic but only checked the xlink:href attribute against the SVG_ALLOW_LOCAL_HREF allowlist; per the SVG 2 specification, browsers also accept a plain href attribute, which was left unrestricted. The fix (commit 74dcb80) updates the check to use Loofah's SVG_HREF_ATTRIBUTES set (requiring Loofah >= 2.25.2), covering both href and xlink:href. Exploitation requires that an attacker can submit content containing SVG markup to an application that has explicitly enabled <use> or <feImage> in its sanitizer configuration (GitHub Advisory, GitHub Commit).

A successful exploit via the <use> element allows a same-origin external SVG file containing scripts to execute in the context of the sanitized document, enabling stored or reflected XSS attacks that could steal session tokens, perform actions on behalf of victims, or exfiltrate sensitive data. The <feImage> element can be abused to silently load external images, enabling user tracking and potential information leakage (e.g., IP address, browser fingerprint). The impact is limited to applications with non-default sanitizer configurations that explicitly permit these SVG elements, and user interaction (visiting a page with malicious content) is required (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.396%, reflecting a low probability of near-term exploitation. Exploitation is not automatable and requires active user interaction, further limiting its practical risk (GitHub Advisory).

1. Identify a vulnerable target: Find a Rails application using rails-html-sanitizer >= 1.0.3 and < 1.7.1 that has overridden the default allowed tags to include <use> or <feImage> SVG elements in its sanitizer configuration.
2. Craft a malicious SVG payload: Prepare an external SVG file hosted on a same-origin server (e.g., an uploaded file endpoint) that contains JavaScript (e.g., <script>alert(document.cookie)</script>).
3. Inject the reference element: Submit content to the application containing a <use href="/path/to/malicious.svg#id"> or <feImage href="https://attacker.example/track.png"> element. Because the sanitizer does not strip the plain href attribute, the reference passes through sanitization intact.
4. Trigger victim execution: Lure a victim user to view the page containing the sanitized (but still malicious) content. The browser fetches and renders the referenced SVG, executing any embedded scripts in the document's origin context or loading the tracking image.
5. Achieve objective: Collect session cookies, perform CSRF actions, or log the victim's IP/browser details via the external image request (GitHub Advisory, GitHub Commit).

• Network: Outbound HTTP requests from a user's browser to unexpected same-origin paths ending in .svg, or to external domains for image resources, originating from pages that render user-supplied content.
• Logs: Web server access logs showing requests to SVG files from referrer URLs corresponding to pages that sanitize user HTML input; external image load requests (e.g., to tracking domains) triggered from sanitized content pages.
• File System: Presence of SVG files containing <script> tags in user-upload directories or content storage locations.
• Application: User-submitted content in the database containing <use href="..."> or <feImage href="..."> elements with non-local (non-#fragment) href values (GitHub Advisory).

Upgrade rails-html-sanitizer to version 1.7.1 or later, which also requires Loofah >= 2.25.2 as a dependency (GitHub Release). As a workaround without upgrading, remove use and feImage from any overridden allowed-tags lists in the sanitizer configuration. Applications using the default allowed tags require no action, as these SVG elements are not included by default (GitHub Advisory).

The vulnerability was discovered by maintainer Mike Dalessio (flavorjones) during a security audit and is closely related to GHSA-9wjq-cp2p-hrgf, a parallel issue in the Loofah library that rails-html-sanitizer mirrors. Red Hat has tracked the issue in their Bugzilla system with medium severity. No significant broader media coverage or notable community debate has been observed beyond the standard advisory channels (GitHub Advisory, Red Hat Bugzilla).