Stored XSS in PictureView figcaption via html_safe on User Caption
Published: July 22, 2026
SECURITY IDENTIFIERS
- GHSA: GHSA-pm72-wq9v-wvfh
- Vendor Advisory: https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh
GEM
SEVERITY
CVSS v3.x: 5.4 (Medium)
PATCHED VERSIONS
~> 8.0.16
~> 8.1.15
~> 8.2.9
>= 8.3.5
DESCRIPTION
Summary
Alchemy::Ingredients::PictureView#caption calls ingredient.caption.html_safe and passes the result to content_tag(:figcaption, …). The caption value is user-supplied (set via the ingredients_attributes[caption] parameter in the element save API) and is stored in a JSON data column with no sanitization. Because .html_safe is called before content_tag, Rails' automatic HTML escaping is suppressed and the raw user string is emitted into the published page, executing in every visitor's browser.
RELATED
- https://rubygems.org/gems/alchemy_cms/versions/8.3.5 - https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.3.5 - https://github.com/AlchemyCMS/alchemy_cms/pull/4081
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.2.9
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.1.15
- https://github.com/AlchemyCMS/alchemy_cms/releases/tag/v8.0.16
- https://github.com/AlchemyCMS/alchemy_cms/security/advisories/GHSA-pm72-wq9v-wvfh