CVE-2026-73648

CVE-2026-73648 is a cross-site scripting vulnerability in rails-html-sanitizer that specifically affects applications using custom SVG sanitization configurations. The library correctly sanitized xlink:href attributes but failed to apply the same logic to plain href attributes in SVG elements — specifically feImage. Since browsers resolve both attribute types identically from a security perspective, this gap allowed script injection through href when the sanitizer was configured to permit SVG content. The critical asymmetry here is who bears the risk. Applications using default configurations are not affected — the vulnerability only manifests when a developer has explicitly configured the sanitizer to allow SVG elements, typically because they have legitimate requirements for rich SVG content. These developers are already managing greater complexity, yet they inherit a security burden that default-path users never see. The CVSS 5.1 score compounds this problem by making the issue appear modest to security teams scanning ticketing queues, when in reality it targets precisely the population doing the most complex, production-critical work with this library. The root cause is instructive: the original xlink:href fix was correct for the SVG 1.1 threat model, where xlink:href was the canonical reference mechanism. When SVG 2.0 deprecated xlink:href in favor of plain href, the security boundary should have been reaudited — it was not. This is spec drift, where the threat model shifts with evolving standards but the security implementation fossilizes. What to do: First, determine whether your application uses custom HTML sanitizer configuration that permits SVG elements. If you are on rails-html-sanitizer versions prior to 1.7.1 and using custom SVG sanitization, upgrade immediately. Second, audit your custom configuration to confirm it handles both href and xlink:href equivalently — do not assume the upgrade alone solves the problem if you have customallowlists. Third, examine downstream trust chains: applications at this configuration complexity level almost certainly pass sanitized content to email systems, PDF generators, APIs, or cached fragments. The blast radius of a bypass at this trust boundary is disproportionate to the narrow exploitability condition. This CVE demonstrates why configuration-dependent vulnerabilities resist simple severity scoring. The population is narrow but high-value, and the burden of detection falls on precisely the developers least likely to receive help from generic security tooling.

Reviewed through automated stages and approved by a human before publication.