{"id":"GHSA-p4x4-rw2p-8j8m","summary":"Cross-site Scripting in Sanitize ","details":"When HTML is sanitized using Sanitize's \"relaxed\" config or a custom config that allows certain elements, some content in a `\u003cmath\u003e` or `\u003csvg\u003e` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.\n\nYou are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:\n\n- `iframe`\n- `math`\n- `noembed`\n- `noframes`\n- `noscript`\n- `plaintext`\n- `script`\n- `style`\n- `svg`\n- `xmp`\n\n### Impact\n\nUsing carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.\n\n### Releases\n\nThis problem has been fixed in Sanitize 5.2.1.\n\n### Workarounds\n\nIf upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:\n\n```ruby\n%w[iframe math noembed noframes noscript plaintext script style svg xmp]\n```\n\nFor example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:\n\n```ruby\ncustom_config = Sanitize::Config.merge(\n  Sanitize::Config::RELAXED,\n  :remove_contents =\u003e %w[iframe math noembed noframes noscript plaintext script style svg xmp]\n)\n```\n\nYou would then pass this custom config to Sanitize when sanitizing HTML.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).\n- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).\n\n### Credits\n\nMany thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.\n\n### References\n\n- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)\n- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)\n- https://github.com/rgrove/sanitize/releases/tag/v5.2.1","aliases":["CVE-2020-4054"],"modified":"2026-07-08T06:29:13.144817987Z","published":"2020-06-16T22:08:06Z","database_specific":{"github_reviewed_at":"2020-06-16T21:42:41Z","nvd_published_at":null,"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-4054"},{"type":"WEB","url":"https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9"},{"type":"PACKAGE","url":"https://github.com/rgrove/sanitize"},{"type":"WEB","url":"https://github.com/rgrove/sanitize/releases/tag/v5.2.1"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sanitize/CVE-2020-4054.yml"},{"type":"WEB","url":"https://usn.ubuntu.com/4543-1"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4730"}],"affected":[{"package":{"name":"sanitize","ecosystem":"RubyGems","purl":"pkg:gem/sanitize"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"5.2.1"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","4.0.0","4.0.1","4.1.0","4.2.0","4.3.0","4.4.0","4.5.0","4.6.0","4.6.1","4.6.2","4.6.3","4.6.4","4.6.5","4.6.6","5.0.0","5.1.0","5.2.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/06/GHSA-p4x4-rw2p-8j8m/GHSA-p4x4-rw2p-8j8m.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"}]}