CVE-2026-73648
CVE-2026-73648: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.4
Medium [CVE-2026-73648] Cross-Site Scripting vulnerability due to improper SVG sanitization
CVE-2026-73648Source published Source updated
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. This issue is fixed in version 1.7.1. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by exploiting improper sanitization of SVG (Scalable Vector Graphics) reference elements.…
- Affected products in this advisory
- Red Hat 3scale API Management Platform 2
- Red Hat Satellite 6
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- 1.7.1
- Mitigation guidance
- If the sanitizer's allowed tags have been overridden, remove SVG reference elements such as use and feImage from that list. Applications using the default allowed tags are not affected. Upgrade to rails-html-sanitizer 1.7.1 or later where a fix is available.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.