Rails::HTML::PermitScrubber, used to sanitize HTML fragments in Rails applications, fails to block SVG elements that use the plain href attribute; only xlink:href was restricted. This weakness, identified as CWE‑79, allows injection of external SVG resources that can execute scripts in the context of the sanitized document or enable tracking via external images. The result is a cross‑site scripting vulnerability where malicious input can run client‑side code or transmit data to an attacker. The vulnerability can affect confidentiality, integrity, and availability of the application’s front‑end if user input is rendered after sanitization.

Any Rails application employing the rails‑html‑sanitizer library between versions 1.0.3 and 1.7.0 – inclusive – and using non‑default allowed tags that include SVG elements such as <use> or <feImage>. Applications that rely on the default allowed tags list do not fall under the affected range. The fix is released in version 1.7.1, which removes the oversight.

The CVSS score of 5.1 classifies this issue as medium severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through crafted user‑generated content that the application sanitizes, then renders in a browser. An attacker who can inject such content may trigger execution of arbitrary JavaScript or cause exfiltration of data via external image loads. While the vulnerability is not a denial‑of‑service flaw, its potential to compromise client‑side code can lead to wider compromises in the application context.