Cloudanix VulnDB

CVE-2026-73648

None

CVSS

—

EPSS

0.5%

Published

Aug 13, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how certain web applications clean user-submitted graphics content could let attackers run unwanted code or track visitors in browsers.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Library
Class
XSS
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The sanitizer fails to block SVG reference elements using the plain href attribute on use and feImage tags, allowing external references when custom allowed tags include these elements.

Why it matters to the business

Applications permitting custom SVG tags could expose users to script execution or tracking via external references, potentially leading to compromised user sessions or data leakage.

How an attack unfolds

An attacker identifies an application that allows non-default SVG tags, crafts input containing use or feImage elements with href pointing to a same-origin malicious SVG, submits it for sanitization, and the rendered output executes scripts or loads tracking images in the victim's browser context.

How to fix it

Upgrade rails-html-sanitizer to version 1.7.1 or later; review and restrict any custom allowed tags that include SVG use or feImage elements.

How to confirm the fix worked

Confirm rails-html-sanitizer version is 1.7.1 or higher; test sanitization behavior on SVG fragments containing href attributes on use and feImage elements to ensure external references are stripped.

Typical attack path

  1. Locate application permitting custom SVG tags in sanitization
  2. Craft malicious SVG payload using href instead of xlink:href on use or feImage
  3. Submit payload through user-controlled HTML input
  4. Trigger rendering of sanitized content in browser to achieve script execution or external image load

How to detect it

Review application logs and sanitized HTML outputs for unexpected external references in SVG use or feImage elements; monitor for unusual script execution or image loads originating from sanitized content.

What your security team should do

  • Upgrade to the fixed version without delay
  • Audit custom tag configurations for SVG elements
  • Implement additional output encoding for any remaining SVG content

The record

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. Applications using the default allowed tags are not affected. This issue is fixed in version 1.7.1.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities