CVE-2024-53989: Rails HTML Sanitizers XSS Vulnerability

CVE-2024-53989 Overview

CVE-2024-53989 is a cross-site scripting (XSS) vulnerability in rails-html-sanitizer version 1.6.0 when used with Rails 7.1.0 or later. The flaw affects applications that enable HTML5 sanitization and override the sanitizer's allowed tags to include the noscript element. Under these conditions, an attacker can inject content that bypasses the sanitizer and executes in the victim's browser. The issue is tracked as [CWE-79] and is fixed in version 1.6.1.

Critical Impact
Attackers can inject script content into pages rendered by Rails applications that permit noscript in the sanitizer allowlist, leading to XSS against end users.

Affected Products

rails-html-sanitizer 1.6.0
Rails applications running Rails >= 7.1.0 with HTML5 sanitization enabled
Applications that override PermitScrubber allowed tags to include noscript

Discovery Timeline

2024-12-02 - CVE-2024-53989 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-53989

Vulnerability Analysis

The vulnerability exists in the PermitScrubber component of rails-html-sanitizer. When Rails 7.1.0 or later is configured to use the HTML5 sanitizer backend, the parser handles noscript content differently than the legacy HTML4 parser. If a developer explicitly adds noscript to the list of permitted tags, the sanitizer allows the element through without safely neutralizing its inner content. Browsers then parse the previously sanitized text inside noscript as active HTML when scripting is disabled, providing a path for script injection.

Root Cause

The root cause is a parser mismatch. The HTML5 sanitizer treats noscript children as raw text during sanitization, but browsers parse those children as markup at render time. Allowing noscript in the safe list therefore preserves attacker-controlled content that is later interpreted as executable HTML.

Attack Vector

Exploitation requires an application that stores or reflects user-supplied HTML sanitized with a customized allowlist including noscript. An attacker submits crafted HTML containing a noscript element wrapping malicious markup. When rendered, the payload escapes the intended sanitization boundary and executes in the context of the origin.

ruby

           if var && !var.is_a?(Enumerable)
             raise ArgumentError, "You should pass :#{name} as an Enumerable"
           end
+
+          if var && name == :tags && var.include?("noscript")
+            warn("WARNING: 'noscript' tags cannot be allowed by the PermitScrubber and will be scrubbed")
+            var.delete("noscript")
+          end
+
           var
         end

Source: rails/rails-html-sanitizer commit 16251735. The patch explicitly removes noscript from any developer-supplied :tags list and emits a warning, preventing the unsafe configuration.

Detection Methods for CVE-2024-53989

Indicators of Compromise

Stored or reflected content containing <noscript> tags wrapping additional HTML elements such as <img>, <style>, or <script>.
Application log entries showing sanitized HTML submissions from unauthenticated or low-trust users that include noscript markup.
Browser console errors or CSP violation reports referencing script execution inside noscript blocks.

Detection Strategies

Audit Rails application source for calls to sanitize or PermitScrubber that pass a custom :tags array including "noscript".
Run dependency scans against Gemfile.lock to identify projects pinned to rails-html-sanitizer 1.6.0 on Rails 7.1+.
Review web application firewall telemetry for HTTP request bodies containing noscript elements combined with executable attributes such as onload or onerror.

Monitoring Recommendations

Ingest Rails application logs and dependency inventories into a centralized analytics platform to flag vulnerable gem versions.
Deploy Content Security Policy (CSP) reporting to surface unexpected inline script execution.
Monitor outbound requests from user browsers for unexpected callbacks that indicate successful XSS.

How to Mitigate CVE-2024-53989

Immediate Actions Required

Upgrade rails-html-sanitizer to version 1.6.1 or later across all Rails applications.
Remove "noscript" from any custom allowed tag lists passed to the sanitizer.
Regenerate and redeploy application containers and bundles after upgrading the gem.

Patch Information

The fix is included in rails-html-sanitizer 1.6.1. See the GitHub Security Advisory GHSA-rxv5-gxqc-xx8g and the upstream patch commit for implementation details.

Workarounds

If upgrading is not immediately possible, remove noscript from any :tags option supplied to Rails::HTML::Sanitizer or PermitScrubber.
Revert to the HTML4 sanitizer backend on Rails 7.1+ if the application does not require HTML5 parsing.
Apply strict Content Security Policy directives that disallow inline scripts to reduce the impact of successful injection.

bash

# Update the gem in your Rails project
bundle update rails-html-sanitizer

# Verify the installed version is 1.6.1 or later
bundle info rails-html-sanitizer | grep -i version