LiveActive security incident?Get immediate response
CVE Record

CVE-2022-32209: # Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain co...

# Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both `select` and `style` elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:```ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]```see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a `:tags` option to the Action View helper `sanitize`:```<%= sanitize @comment.body, tags: ["select", "style"] %>```see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:```ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]```or```ruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])```All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either `select` or `style` from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by [windshock](https://hackerone.com/windshock?type=user).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

Rails HTML sanitization could fail in a narrow configuration: apps that allowed both select and style tags. If user-supplied HTML is sanitized this way, an attacker may inject browser-executed content. The published fix is rails-html-sanitizer v1.4.3.

Executive priority

Treat as a targeted remediation item, not an emergency based on current evidence. Prioritize applications that accept user-generated HTML and customize Rails sanitizer tags. Upgrade or remove the risky tag combination during the next security maintenance window, sooner for public-facing content workflows.

Technical view

CVE-2022-32209 is a CWE-79 XSS issue in Rails::Html::Sanitizer. Sources state all versions before fixed v1.4.3 are affected, but only when allowed tags are overridden to include both select and style via configuration, sanitize helper tags, or SafeListSanitizer options.

Likely exposure

Exposure is likely limited to Ruby/Rails applications using rails-html-sanitizer with customized allowed tags containing both select and style, especially where untrusted HTML is rendered. Sources do not claim default configurations are exploitable or provide broad internet exposure evidence.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. Public reporting describes a possible XSS condition and names the required sanitizer configuration, but this analysis avoids exploit mechanics and cannot confirm weaponized use from the provided sources.

Researcher notes

The key exposure question is configuration, not merely package presence. The advisory explicitly requires overridden allowed tags containing both select and style. Evidence in the supplied bundle is sufficient for affected-condition validation, but incomplete for CVSS severity, exploit prevalence, or default-configuration impact.

Mitigation direction

  • Upgrade rails-html-sanitizer to v1.4.3 or later where applicable.
  • Remove either select or style from overridden sanitizer allowed tags.
  • Review Rails app configuration for customized sanitized_allowed_tags.
  • Check distribution security updates if using Fedora or Debian packages.
  • Monitor vendor advisories for environment-specific guidance.

Validation and detection

  • Inventory rails-html-sanitizer versions in application dependencies and packaged runtimes.
  • Search for sanitized_allowed_tags including both select and style.
  • Review sanitize helper calls using tags options.
  • Review SafeListSanitizer class-level and instance-level allowed_tags overrides.
  • Confirm user-controlled HTML paths use a fixed sanitizer configuration.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-32209 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/ahttps://github.com/rails/rails-html-sanitizerv1.4.3Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs