{
  "cveId": "CVE-2023-23627",
  "url": "https://patchblox.com/security/cve/CVE-2023-23627",
  "summary": "CVE-2023-23627 is fixed in ruby-sanitize on 1 platform, first by DEBIAN-CVE-2023-23627, released January 28, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ruby-sanitize: Sanitize is an allowlist-based HTML and CSS sanitizer",
  "description": "Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 and later, prior to 6.0.1, are vulnerable to Cross-site Scripting. When Sanitize is configured with a custom allowlist that allows \u0060noscript\u0060 elements, attackers are able to include arbitrary HTML, resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. The default configurations do not allow \u0060noscript\u0060 elements and are not vulnerable. This issue only affects users who are using a custom config that adds \u0060noscript\u0060 to the element allowlist. This issue has been patched in version 6.0.1. Users who are unable to upgrade can prevent this issue by using one of Sanitize\u0027s default configs or by ensuring that their custom config does not include \u0060noscript\u0060 in the element allowlist.",
  "published": "2023-01-27T16:15:00Z",
  "severity": "Medium",
  "cvss": 6.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "epss": 0.00539,
  "epssPercentile": 0.45623,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ruby-sanitize",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.0.0-1.1",
      "fix": "DEBIAN-CVE-2023-23627",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-23627",
      "released": "2023-01-28T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sanitize",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.0.0-1.1",
      "fix": "DEBIAN-CVE-2023-23627",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-23627",
      "released": "2023-01-28T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sanitize",
      "release": "Debian 14",
      "fixedVersion": "6.0.0-1.1",
      "fix": "DEBIAN-CVE-2023-23627",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-23627",
      "released": "2023-01-28T00:15:09Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sanitize",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "4.6.6-2.1~0.20.04.2",
      "fix": "ruby-sanitize 4.6.6-2.1~0.20.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-sanitize-4.6.6-2.1-0.20.04.2",
      "released": "2023-07-06T09:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-sanitize",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "6.0.0-1ubuntu0.1",
      "fix": "ruby-sanitize 6.0.0-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-sanitize-6.0.0-1ubuntu0.1",
      "released": "2023-07-06T09:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}