CVE-2026-128068: Regular Expression Denial of Service in rails-html-sanitizer

Vulnerability ID: CVE-2026-128068
CVSS Score: 5.3
Published: 2026-11-13

CVE-2026-128068 (GHSA-cpgf-5mjf-73p7) is a Regular Expression Denial of Service (ReDoS) vulnerability in the rails-html-sanitizer Ruby gem affecting versions 1.0.3 through 1.7.1. The flaw resides in the Rails::HTML::PermitScrubber#scrub_attribute method, which uses the multiline regular expression /^\s*[^#\s].*/m to enforce local-only URI fragment references on SVG elements. On Ruby runtimes prior to version 3.2 (CRuby <= 3.1 and JRuby), evaluating an attribute value composed of repeated newline and whitespace characters without a hash character triggers quadratic backtracking O(n^2). Applications are only vulnerable if their sanitization allowlist is explicitly configured to permit SVG reference elements such as alongside href or xlink:href attributes.

TL;DR

A quadratic Regular Expression Denial of Service (ReDoS) vulnerability exists in rails-html-sanitizer (>= 1.0.3, < 1.7.2) when scrubbing SVG href and xlink:href attributes. Applications running on Ruby 3.1 or earlier (or JRuby) that customize their HTML sanitizer allowlist to permit SVG reference tags can suffer worker thread exhaustion when processing crafted multiline whitespace payloads.

⚠️ Exploit Status: POC

Technical Details

• CVE ID: CVE-2026-128068 (GHSA-cpgf-5mjf-73p7)
• Weakness Class: CWE-1333 (Inefficient Regular Expression Complexity) / CWE-400
• CVSS v3.1 Score: 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
• Affected Component: Rails::HTML::PermitScrubber#scrub_attribute (rails-html-sanitizer >= 1.0.3, < 1.7.2)
• Affected Runtimes: CRuby <= 3.1 and JRuby (CRuby >= 3.2 is unaffected)
• Impact: Quadratic O(n^2) CPU exhaustion / Worker Thread Denial of Service
• Exploit Status: PoC / Algorithmic Complexity (Not in CISA KEV)
• Patched Version: rails-html-sanitizer 1.7.2 (with loofah >= 2.25.3)

Affected Systems

• rails-html-sanitizer RubyGem (>= 1.0.3, < 1.7.2)
• Ruby on Rails applications on CRuby <= 3.1 or JRuby with custom SVG sanitizer allowlists
• rails-html-sanitizer: >= 1.0.3, < 1.7.2 (Fixed in: 1.7.2)
• loofah: < 2.25.3 (Fixed in: 2.25.3)

Code Analysis

Commit: f776f96

Scrub SVG href attributes in linear time by delegating to Loofah::HTML5::Scrub.scrub_attribute_value and requiring Loofah >= 2.25.3

diff --git a/lib/rails/html/scrubbers.rb b/lib/rails/html/scrubbers.rb
index f777c84..f398dd1 100644
--- a/lib/rails/html/scrubbers.rb
+++ b/lib/rails/html/scrubbers.rb
@@ -160,21 +160,9 @@ def validate!(var, name)
         end

         def scrub_attribute(node, attr_node)
-          attr_name = if attr_node.namespace
-            "#{attr_node.namespace.prefix}:#{attr_node.node_name}"
-          else
-            attr_node.node_name
-          end
-
-          return if Loofah::HTML5::SafeList::ATTR_VAL_IS_URI.include?(attr_name) && Loofah::HTML5::Scrub.scrub_uri_attribute(attr_node)
+          attr_name = Loofah::HTML5::Scrub.prefixed_attribute_name(attr_node)

-          if Loofah::HTML5::SafeList::SVG_ATTR_VAL_ALLOWS_REF.include?(attr_name)
-            Loofah::HTML5::Scrub.scrub_attribute_that_allows_local_ref(attr_node)
-          end
-
-          if Loofah::HTML5::SafeList::SVG_ALLOW_LOCAL_HREF.include?(node.name) && Loofah::HTML5::SafeList::SVG_HREF_ATTRIBUTES.include?(attr_name) && attr_node.value =~ /^\s*[^#\s].*/m
-            attr_node.remove
-          end
+          return if Loofah::HTML5::Scrub.scrub_attribute_value(node, attr_node, attr_name)

           node.remove_attribute(attr_node.name) if attr_name == "src" && attr_node.value !~ /[^[:space:]]/

Mitigation Strategies

• Upgrade rails-html-sanitizer to version 1.7.2 or later and loofah to version 2.25.3 or later.
• Upgrade the Ruby runtime to CRuby 3.2 or later to benefit from built-in linear-time regular expression memoization.
• Audit and restrict custom HTML sanitizer allowlists to remove SVG reference tags (such as ) or disallow href and xlink:href attributes.
• Enforce strict payload size limits on user-submitted HTML inputs at the reverse proxy or web application firewall (WAF) layer.

Remediation Steps:

1. Check your Gemfile.lock for rails-html-sanitizer version (< 1.7.2) and Ruby version (< 3.2.0).
2. Inspect application code and initializers for custom sanitize calls or config.action_view.sanitized_allowed_tags overrides permitting SVG elements.
3. Update rails-html-sanitizer and loofah via 'bundle update rails-html-sanitizer loofah'.
4. Verify the test suite passes and redeploy the application.

References

• CVE-2026-128068 Official CVE Record
• GitHub Security Advisory GHSA-cpgf-5mjf-73p7
• Patch Commit f776f963b9d9346271aade9cb903e793fd38e865
• rails-html-sanitizer v1.7.2 Release Notes
• Ruby Advisory Database Entry for GHSA-cpgf-5mjf-73p7
• rails-html-sanitizer GitHub Repository

Read the full report for CVE-2026-128068 on our website for more details including interactive diagrams and full exploit analysis.