CVE-2024-53988: Rails HTML Sanitizers XSS Vulnerability

CVE-2024-53988 Overview

CVE-2024-53988 is a cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem, version 1.6.0, when used with Rails 7.1.0 or later. The library sanitizes HTML fragments in Ruby on Rails applications. When HTML5 sanitization is enabled and an application developer overrides the sanitizer's allowed tags to permit math, mtext, table, and style elements together with either mglyph or malignmark, an attacker can inject executable content. The flaw is categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. The maintainers addressed the issue in version 1.6.1.

Critical Impact
Attackers can inject script content into Rails applications that use HTML5 sanitization with custom allowlists containing MathML foreign-content elements.

Affected Products

rails-html-sanitizer 1.6.0
Ruby on Rails applications running Rails 7.1.0 or later with HTML5 sanitization enabled
Applications overriding PermitScrubber allowed tags to include the vulnerable element combination

Discovery Timeline

2024-12-02 - CVE-2024-53988 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53988

Vulnerability Analysis

The vulnerability arises from how HTML5 parsers treat MathML foreign-content integration points. Elements such as mglyph and malignmark change the parser's insertion mode when nested inside math or mtext. Content that follows these tags is parsed as HTML rather than MathML. When a style element or a table element appears inside this switched context, the sanitizer's tag-based allowlist no longer maps cleanly to the parsed DOM. An attacker can craft input that survives sanitization but is later parsed by the browser as active script content.

Root Cause

The root cause is a mismatch between the sanitizer's allowlist logic and the HTML5 parser's foreign-content handling. Rails::HTML::Sanitizer version 1.6.0 permitted developers to add mglyph and malignmark to the tag allowlist without warning. Combined with math, mtext, table, and style, this configuration produces a parser state that reintroduces script execution paths inside otherwise sanitized markup.

Attack Vector

Exploitation requires the target application to have overridden the default allowed tags to include the specific vulnerable combination. An unauthenticated attacker submits crafted HTML through any input field that is later rendered through the sanitizer. User interaction is required to trigger the injected payload in a victim's browser.

ruby

# Source: https://github.com/rails/rails-html-sanitizer/commit/a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72
# Patch in lib/rails/html/scrubbers.rb - disallow 'mglyph' and 'malignmark' from safe lists
if var && !var.is_a?(Enumerable)
  raise ArgumentError, "You should pass :#{name} as an Enumerable"
end

if var && name == :tags
  if var.include?("mglyph")
    warn("WARNING: 'mglyph' tags cannot be allowed by the PermitScrubber and will be scrubbed")
    var.delete("mglyph")
  end

  if var.include?("malignmark")
    warn("WARNING: 'malignmark' tags cannot be allowed by the PermitScrubber and will be scrubbed")
    var.delete("malignmark")
  end
end

var

The patch enforces removal of mglyph and malignmark from any user-supplied tag allowlist and emits a warning to the developer.

Detection Methods for CVE-2024-53988

Indicators of Compromise

HTML input containing math or mtext elements nested with mglyph or malignmark tags
Sanitized output that still contains style blocks or event-handler attributes inside MathML contexts
Application logs showing unexpected script execution or content rendering in comment fields, forum posts, or CMS bodies

Detection Strategies

Inventory Ruby projects with Gemfile.lock entries pinning rails-html-sanitizer at 1.6.0 or earlier
Grep application code for calls to PermitScrubber or Rails::HTML5::SafeListSanitizer that pass a custom :tags allowlist including MathML elements
Run dependency scanners against CI pipelines to flag vulnerable versions before deployment

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture blocked inline script executions originating from user-generated content
Log deprecation warnings emitted by the 1.6.1 patch to identify unsafe allowlist configurations
Monitor web application firewall (WAF) telemetry for MathML tag combinations in POST bodies

How to Mitigate CVE-2024-53988

Immediate Actions Required

Upgrade rails-html-sanitizer to version 1.6.1 or later across all Rails applications
Audit application code for custom PermitScrubber allowlists that expand the default tag set
Remove mglyph and malignmark from any developer-defined allowlist even after upgrading

Patch Information

The fix is contained in commit a0a3e8b76b696446ffc6bffcff3bc7b7c6393c72 and released in rails-html-sanitizer 1.6.1. See the GitHub Security Advisory GHSA-cfjx-w229-hgx5 and the upstream commit for full details.

Workarounds

Revert to the default sanitizer allowlist instead of overriding it with a custom tag set
Disable HTML5 sanitization if the application does not require MathML support
Apply a strict Content Security Policy that blocks inline scripts and styles from user-generated content

bash

# Update the gem to the patched release
bundle update rails-html-sanitizer --conservative

# Verify the installed version
bundle info rails-html-sanitizer | grep -i version