Impact

With the HTML5 sanitizer (Rails::HTML5::Sanitizer, the default vendor on CRuby for applications using load_defaults 7.1 or later), Nokogiri before 1.19.5 serializes < and > unescaped inside attribute values. The Action View text helpers highlight and simple_format sanitize their input and then process the resulting HTML as a string: highlight splits it on tag boundaries to insert matches, and simple_format splits it into paragraphs on blank lines. An unescaped > or a blank line inside an attribute value could cause markup in that value, which the sanitizer left inert, to be emitted as live elements in the helper's html_safe output, possibly leading to XSS. Applications that use the HTML5 sanitizer and pass untrusted text to highlight, or to simple_format with html_options, are affected.

Details

The fixed releases require rails-html-sanitizer 1.7.2 or later, which requires Loofah 2.25.3 and Nokogiri 1.19.5. With these versions, the HTML5 sanitizer escapes < and > in attribute values as < and >, as the HTML4 sanitizer already does. The parsed DOM is unchanged, but code or tests that compare sanitized HTML as a string may see the new serialization.

Workarounds

Upgrade Nokogiri to 1.19.5 or later; the escaping is in its HTML5 serializer, so no Rails upgrade is needed. Alternatively, use the HTML4 sanitizer by setting config.action_view.sanitizer_vendor = Rails::HTML4::Sanitizer.

Releases

The fixed releases are available at the normal locations.

Patches for those who cannot upgrade at once:

• 8.1: https://github.com/rails/rails/commit/adc3a32d4abea77ed3aacf6f5fb71cfc005bef73.patch
• 8.0: https://github.com/rails/rails/commit/009ea68342d05d02087c04dae7faaa4e4c1def11.patch

Credit

This issue was responsibly reported by HackerOne researcher azaran. This issue was also found by the Anthropic OSS Scanner (ANT-2026-RTK47OH0).