CVE-2024-53987: Rails HTML Sanitizer XSS Vulnerability

CVE-2024-53987 Overview

CVE-2024-53987 is a cross-site scripting (XSS) vulnerability [CWE-79] in rails-html-sanitizer version 1.6.0 when used with Rails 7.1.0 or later. The flaw affects applications that enable HTML5 sanitization and override the allowed tag list to permit style while excluding svg and math. Under this configuration, an attacker can inject content that bypasses sanitization through namespace confusion in foreign contexts. The maintainers fixed the issue in version 1.6.1 by pruning namespaced nodes rather than unwrapping them.

Critical Impact
Attackers can inject executable script content into sanitized HTML output, enabling XSS against users of affected Rails applications with the specific vulnerable sanitizer configuration.

Affected Products

rails-html-sanitizer 1.6.0
Rails applications on Rails >= 7.1.0 using HTML5 sanitization
Applications overriding allowed tags to include style while excluding svg and math

Discovery Timeline

2024-12-02 - CVE-2024-53987 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53987

Vulnerability Analysis

The rails-html-sanitizer gem sanitizes HTML fragments in Rails applications by removing tags outside an allowed list. When HTML5 sanitization is active and a developer permits the style element without also permitting svg and math, the sanitizer removes the foreign-context container but preserves its children. Content nested inside these foreign contexts retains an SVG or MathML namespace after being lifted into the HTML namespace, producing a mutation XSS condition. Because style handling differs between HTML and foreign contexts, attacker-controlled markup can escape the sanitized boundary and execute in the browser.

Root Cause

The scrub_node method in lib/rails/html/scrubbers.rb unwrapped disallowed nodes by moving their children before removing the parent. When the disallowed parent was an svg or math element, its children retained a foreign namespace but were reparented into an HTML context. This namespace confusion allowed markup that would be inert in a foreign context to execute after mutation.

Attack Vector

An attacker submits crafted HTML containing svg or math wrappers with nested style or other elements to a Rails endpoint that sanitizes user input. When the sanitizer strips the outer foreign-context element while retaining child nodes, the browser reinterprets the surviving nodes in an HTML context and executes injected script.

ruby

        end

        def scrub_node(node)
-          node.before(node.children) unless prune # strip
+          # If a node has a namespace, then it's a tag in either a `math` or `svg` foreign context,
+          # and we should always prune it to avoid namespace confusion and mutation XSS vectors.
+          unless prune || node.namespace
+            node.before(node.children)
+          end
          node.remove
        end

Source: rails-html-sanitizer commit f02ffbb. The patch prunes any namespaced node instead of unwrapping its children, eliminating the mutation vector.

Detection Methods for CVE-2024-53987

Indicators of Compromise

Sanitized output containing residual svg or math child elements after processing user input
Unexpected style blocks with CSS expressions or CSS-based script vectors appearing in rendered pages
Application error logs referencing sanitizer scrubber operations on foreign-context markup

Detection Strategies

Audit Gemfile.lock across Rails applications for rails-html-sanitizer (1.6.0) combined with Rails 7.1.0 or later
Review sanitizer configurations for overrides that add style to allowed_tags while omitting svg and math
Perform dynamic testing by submitting payloads that embed styled content inside svg and math wrappers and inspecting rendered DOM

Monitoring Recommendations

Log and alert on HTTP requests containing <svg> or <math> tags to endpoints that accept user-generated HTML
Monitor Content Security Policy (CSP) violation reports for inline script or style violations from sanitized user content
Track dependency updates in CI pipelines to flag applications remaining on rails-html-sanitizer 1.6.0

How to Mitigate CVE-2024-53987

Immediate Actions Required

Upgrade rails-html-sanitizer to version 1.6.1 or later
Inventory Rails applications using HTML5 sanitization and review custom allowed_tags configurations
Deploy or tighten Content Security Policy headers to reduce the impact of any residual XSS exposure

Patch Information

The fix is available in rails-html-sanitizer 1.6.1. See the GitHub Security Advisory GHSA-2x5m-9ch4-qgrr and the upstream commit f02ffbb for the patched scrub_node logic.

Workarounds

Remove style from the sanitizer's allowed_tags until the gem is upgraded
Add svg and math to allowed_tags alongside style so the vulnerable unwrap path is not triggered
Switch affected endpoints to the non-HTML5 (libxml2-based) sanitizer configuration until patching is complete

bash

# Update the gem to the fixed release
bundle update rails-html-sanitizer

# Verify the installed version is 1.6.1 or later
bundle info rails-html-sanitizer | grep -i version