{"action":"Upgrade rails-html-sanitizer to 1.4.4 or later.","affected":[{"fixed":"1.4.4","introduced":"1.0.3"}],"component":"rails-html-sanitizer","cve_ids":["CVE-2022-23518"],"ecosystem":"RubyGems","epss":0.00925,"exploited":false,"fixed_versions":["1.4.4"],"ghsa_id":"GHSA-mcvf-2q2m-x72m","id":"tcs_01M5KEM6GRDYA945YFSG36H68R","modified_at":"2025-11-04T17:04:00.396884Z","published_at":"2022-12-13T17:45:39Z","references":["https://osv.dev/vulnerability/GHSA-mcvf-2q2m-x72m","https://github.com/rails/rails-html-sanitizer/security/advisories/GHSA-mcvf-2q2m-x72m","https://nvd.nist.gov/vuln/detail/CVE-2022-23518","https://github.com/rails/rails-html-sanitizer/issues/135","https://github.com/w3c/svgwg/issues/266","https://hackerone.com/reports/1694173","https://github.com/rails/rails-html-sanitizer","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails-html-sanitizer/CVE-2022-23518.yml","https://lists.debian.org/debian-lts-announce/2023/09/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00045.html"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-mcvf-2q2m-x72m","url":"https://osv.dev/vulnerability/GHSA-mcvf-2q2m-x72m"}],"summary":"Improper neutralization of data URIs may allow XSS in rails-html-sanitizer"}