CVE-2015-7579: XSS vulnerability in strip_tags

February 15, 2016 (updated August 8, 2019)

Due to the way that Rails::Html::FullSanitizer is implemented, if an attacker passes an already escaped HTML entity to the input of Action View’s strip_tags these entities will be unescaped what may cause a XSS attack if used in combination with raw or html_safe.

References

groups.google.com/forum/

Code Behaviors & Features

Detect and mitigate CVE-2015-7579 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →