CVE-2023-36823

RubyGems/sanitize CVE-2023-36823: high 7.1

Sanitize vulnerable to Cross-site Scripting via insufficient neutralization of `style` element content

Action: Upgrade sanitize to 6.0.2 or later.

bundle update sanitize

Affected

Fixed versions

Sources

• osv: GHSA-f5ww-cq3m-q3g7
• https://github.com/rgrove/sanitize/security/advisories/GHSA-f5ww-cq3m-q3g7
• https://nvd.nist.gov/vuln/detail/CVE-2023-36823
• https://github.com/rgrove/sanitize/commit/76ed46e6dc70820f38efe27de8dabd54dddb5220
• https://github.com/rgrove/sanitize
• https://github.com/rgrove/sanitize/releases/tag/v6.0.2
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2023-36823.yml
• https://lists.debian.org/debian-lts-announce/2023/11/msg00008.html

CVE-2023-36823 · published 2023-07-06T19:45:44Z · modified 2024-02-16T07:55:20.893240Z · JSON