Published about 5 years ago
Category: Attribute Restriction
Source: NIST NVD
Severity: Moderate

Vulnerability in rails-html-sanitizer

There is a XSS vulnerability in Rails::Html::FullSanitizer used by Action View’s strip_tags. This vulnerability has been assigned the CVE identifier CVE-2015-7579.


Due to the way that Rails::Html::FullSanitizer is implemented, if an attacker passes an already escaped HTML entity to the input of Action View’s strip_tags these entities will be unescaped what may cause a XSS attack if used in combination with raw or html_safe.

For example:


Would generate:


After the fix it will generate:


All users running an affected release should either upgrade or use one of the workarounds immediately.


The FIXED releases are available at the normal locations.


If you can’t upgrade, please use the following monkey patch in an initializer that is loaded before your application. E.g., config/initializers/strip_tags_fix.rb:

class ActionView::Base 
  def strip_tags(html) 


To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

  • Do-not-unescape-already-escaped-HTML-entities.patch


Thank you to Arthur Neves from GitHub and Spyros Livathinos from Zendesk for reporting the problem and working with us to fix it.

CVSS Metrics
Access Vector Access Complexity Authentication Confidentiality Impact Integrity Impact Availability Impact
Network Network None None Partial None
Patched Versions

>= 1.0.3

Unaffected Versions

~> 1.0.0 ~> 1.0.1