CVE-2018-3741 — rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

Back Back to CVE browser

MEDIUM

rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability

Published Mar 30, 2018

6.1

MEDIUM

CVSS 3.1

EPSS 1.25%

Description

There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.

Affected products

Vendor Rails Product Rails-Html-Sanitizer Default
n/a
- Version
  <= 1.0.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rails

Rails-Html-Sanitizer

n/a

Version	Status	Constraints
<= 1.0.3	affected	-

CloudForms Management Engine 5.10

ansible-runner-0:1.1.2-2.el7ar

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ansible-tower-0:3.3.3-1.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

bubblewrap-0:0.1.7-1.el7

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

cfme-0:5.10.0.33-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

cfme-amazon-smartstate-0:5.10.0.33-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

cfme-appliance-0:5.10.0.33-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

cfme-gemset-0:5.10.0.33-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

dbus-api-service-0:1.0.1-5.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

dumb-init-0:1.2.0-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

erlang-0:19.3.6.7-1.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

google-compute-engine-0:2.0.0-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

google-config-0:2.0.0-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

httpd-configmap-generator-0:0.2.2-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

nginx-1:1.10.2-1.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-cluster-upgrade-0:1.1.8-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-disaster-recovery-0:1.1.2-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-engine-setup-0:1.1.5-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-image-template-0:1.1.8-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-infra-0:1.1.8-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-manageiq-0:1.1.12-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-repositories-0:1.1.2-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-roles-0:1.1.5-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-shutdown-env-0:1.0.0-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-v2v-conversion-host-0:1.6.3-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ovirt-ansible-vm-infra-0:1.1.10-1.el7ev

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

postgresql96-0:9.6.10-1PGDG.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

prince-0:9.0r2-10.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

pyOpenSSL-0:17.3.0-4.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-bambou-0:3.0.1-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-colorama-0:0.3.7-2.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-crypto-0:2.6.1-16.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-daemon-0:2.1.2-7.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-funcsigs-0:1.0.2-1.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-future-0:0.16.0-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-lockfile-1:0.11.0-10.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-meld3-0:0.6.10-1.el7

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-mock-0:2.0.0-1.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-pbr-0:3.1.1-2.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-pexpect-0:4.6-1.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-psutil-0:5.4.3-2.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-ptyprocess-0:0.5.2-3.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-pylxca-0:2.1.1-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-pysocks-0:1.5.6-3.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-requests-0:2.14.2-1.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-requests-toolbelt-0:0.8.0-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-tabulate-0:0.8.2-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-urllib3-0:1.21.1-1.2.el7ost

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

python-vspk-0:5.3.2-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

qpid-proton-0:0.19.0-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rabbitmq-server-0:3.7.4-1.el7at

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rh-postgresql95-postgresql-pglogical-0:2.1.0-4.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rh-postgresql95-repmgr-0:4.0.6-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

ruby-0:2.4.5-90.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-bcrypt-0:3.1.12-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-ffi-0:1.9.25-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-hamlit-0:2.8.8-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-http_parser.rb-0:0.6.0-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-json-0:2.1.0-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-linux_block_device-0:0.2.1-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-memory_buffer-0:0.1.0-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-nio4r-0:2.3.1-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-nokogiri-0:1.8.2-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-ovirt-engine-sdk4-0:4.2.4-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-pg-0:0.18.4-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-puma-0:3.7.1-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-qpid_proton-0:0.22.0-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-redhat_access_cfme-0:2.0.3-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-redhat_access_lib-0:1.1.4-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-rugged-0:0.27.4-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-sqlite3-0:1.3.13-2.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-unf_ext-0:0.0.7.5-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

rubygem-websocket-driver-0:0.6.5-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

smem-0:1.4-1.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

supervisor-0:3.1.4-1.el7

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

wmi-0:1.3.14-7.el7cf

Fixed · RHSA-2019:0212
CloudForms Management Engine 5.10

wxGTK3-0:3.0.3-5.el7at

Fixed · RHSA-2019:0212
Red Hat Software Collections

rh-ror42-rubygem-rails-html-sanitizer

Will not fix
Red Hat Software Collections

rh-ror50-rubygem-rails-html-sanitizer

Will not fix

Product	Package	State	Advisory
CloudForms Management Engine 5.10	ansible-runner-0:1.1.2-2.el7ar	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ansible-tower-0:3.3.3-1.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	bubblewrap-0:0.1.7-1.el7	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	cfme-0:5.10.0.33-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	cfme-amazon-smartstate-0:5.10.0.33-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	cfme-appliance-0:5.10.0.33-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	cfme-gemset-0:5.10.0.33-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	dbus-api-service-0:1.0.1-5.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	dumb-init-0:1.2.0-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	erlang-0:19.3.6.7-1.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	google-compute-engine-0:2.0.0-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	google-config-0:2.0.0-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	httpd-configmap-generator-0:0.2.2-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	nginx-1:1.10.2-1.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-cluster-upgrade-0:1.1.8-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-disaster-recovery-0:1.1.2-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-engine-setup-0:1.1.5-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-image-template-0:1.1.8-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-infra-0:1.1.8-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-manageiq-0:1.1.12-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-repositories-0:1.1.2-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-roles-0:1.1.5-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-shutdown-env-0:1.0.0-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-v2v-conversion-host-0:1.6.3-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ovirt-ansible-vm-infra-0:1.1.10-1.el7ev	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	postgresql96-0:9.6.10-1PGDG.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	prince-0:9.0r2-10.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	pyOpenSSL-0:17.3.0-4.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-bambou-0:3.0.1-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-colorama-0:0.3.7-2.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-crypto-0:2.6.1-16.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-daemon-0:2.1.2-7.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-funcsigs-0:1.0.2-1.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-future-0:0.16.0-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-lockfile-1:0.11.0-10.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-meld3-0:0.6.10-1.el7	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-mock-0:2.0.0-1.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-pbr-0:3.1.1-2.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-pexpect-0:4.6-1.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-psutil-0:5.4.3-2.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-ptyprocess-0:0.5.2-3.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-pylxca-0:2.1.1-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-pysocks-0:1.5.6-3.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-requests-0:2.14.2-1.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-requests-toolbelt-0:0.8.0-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-tabulate-0:0.8.2-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-urllib3-0:1.21.1-1.2.el7ost	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	python-vspk-0:5.3.2-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	qpid-proton-0:0.19.0-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rabbitmq-server-0:3.7.4-1.el7at	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rh-postgresql95-postgresql-pglogical-0:2.1.0-4.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rh-postgresql95-repmgr-0:4.0.6-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	ruby-0:2.4.5-90.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-bcrypt-0:3.1.12-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-ffi-0:1.9.25-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-hamlit-0:2.8.8-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-http_parser.rb-0:0.6.0-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-json-0:2.1.0-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-linux_block_device-0:0.2.1-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-memory_buffer-0:0.1.0-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-nio4r-0:2.3.1-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-nokogiri-0:1.8.2-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-ovirt-engine-sdk4-0:4.2.4-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-pg-0:0.18.4-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-puma-0:3.7.1-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-qpid_proton-0:0.22.0-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-redhat_access_cfme-0:2.0.3-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-redhat_access_lib-0:1.1.4-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-rugged-0:0.27.4-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-sqlite3-0:1.3.13-2.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-unf_ext-0:0.0.7.5-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	rubygem-websocket-driver-0:0.6.5-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	smem-0:1.4-1.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	supervisor-0:3.1.4-1.el7	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	wmi-0:1.3.14-7.el7cf	Fixed	RHSA-2019:0212
CloudForms Management Engine 5.10	wxGTK3-0:3.0.3-5.el7at	Fixed	RHSA-2019:0212
Red Hat Software Collections	rh-ror42-rubygem-rails-html-sanitizer	Will not fix	n/a
Red Hat Software Collections	rh-ror50-rubygem-rails-html-sanitizer	Will not fix	n/a

Remediation

Red Hat statement

This issue affects the versions of rubygem-rails-html-sanitizer as shipped with Red Hat CloudForms 4. Red Hat Product Security has rated this issue as having a security impact of Moderate. This vulnerability won't be fixed on CloudForms 4, because it uses libxml 2.9.1 and since the vulnerability requires a libxml >= 2.9.2 in order to be exploitable. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/

Metrics

1.25% 0.01253

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01253

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (10 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.25% (0.01253)	68.36th	v5 (v2026.06.15)
Sep 20, 2026	1.25% (0.01253)	68.12th	v5 (v2026.06.15)
Jul 20, 2024	0.08% (0.00079)	34.57th	v3 (v2023.03.01)
Jul 10, 2024	0.08% (0.00079)	34.49th	v3 (v2023.03.01)
Sep 3, 2023	0.08% (0.00078)	32.45th	v3 (v2023.03.01)
Mar 7, 2023	0.06% (0.00061)	23.61th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Feb 4, 2022	0.89% (0.00885)	10.50th	v2 (v2022.01.01)
Feb 3, 2022	0.42% (0.00416)	10.04th	v5 (v2026.06.15)
Apr 14, 2021	0.42% (0.00416)	0.00th	v1

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (6)

https://access.redhat.com/security/cve/CVE-2018-3741
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1568842
Issue Tracking
https://github.com/advisories/GHSA-px3r-jm9g-c8w8
Advisory
https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae
x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-3741
https://www.cve.org/CVERecord?id=CVE-2018-3741

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2018-3741		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1568842		Issue Tracking
https://github.com/advisories/GHSA-px3r-jm9g-c8w8		Advisory
https://github.com/rails/rails-html-sanitizer/commit/f3ba1a839a35f2ba7f941c15e239a1cb379d56ae		x_refsource_CONFIRMIssue TrackingPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-3741
https://www.cve.org/CVERecord?id=CVE-2018-3741