CVE-2022-32209

RubyGems/rails-html-sanitizer CVE-2022-32209: medium 6.1

Rails::Html::Sanitizer vulnerable to Cross-site Scripting

Action: Upgrade rails-html-sanitizer to 1.4.3 or later.

bundle update rails-html-sanitizer

Affected

Fixed versions

Sources

• osv: GHSA-pg8v-g4xq-hww9
• https://nvd.nist.gov/vuln/detail/CVE-2022-32209
• https://github.com/rails/rails-html-sanitizer/commit/45a5c10fed3d9aa141594c80afa06d748fa0967d
• https://hackerone.com/reports/1530898
• https://github.com/rails/rails-html-sanitizer
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-32209.yml
• https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s
• https://lists.debian.org/debian-lts-announce/2022/12/msg00012.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00045.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGRLWBEB3S5AU3D4TTROIS7O6QPHDTRH
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NHDACMCLWE32BZZTSNWQPIFUAD5I6Q47

CVE-2022-32209 · published 2022-06-25T00:00:54Z · modified 2025-11-04T17:02:22.780977Z · JSON