CVE-2018-3741 - CVE House
Back to Database
Status published Medium CVE-2018-3741

There is a possible XSS vulnerability in all rails-html-sanitizer gem...

Vulnerability Description

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-3741

Credits & Attribution

No credits recorded in the NVD database.

References

More from Rails

View All →
CVE-2025-24293
# Active Storage allowed transformation methods potentially unsafe Active Storage attempts...
Critical 9.2
CVE-2023-38037
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file....
Medium 5.5
CVE-2023-28362
The redirect_to method in Rails allows provided values to contain...
Unknown 0
CVE-2023-28120
There is a vulnerability in ActiveSupport if the new bytesplice...
Unknown 0
CVE-2023-27539
There is a denial of service vulnerability in the header...
Unknown 0

Affected Vendor

Affected Software

rails-html-sanitizer
Vulnerable Versions:
<= 1.0.3

Timeline

Official Publish: March 30th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact