version 1.3.0 XSS Vulnerability

[Kashyap H Patel]

Version 1.3.0 still has XSS vulnerabilities. Is there any plans to fix it?

[Rafael Mendonça França]

Which XSS vulnerabilities? Care to expand on that?

[Andy Nicholson]

@rafaelfranca bundle audit reports vulnerabilities for 1.3.0, perhaps erroneously?

I just hit this on my Rails 5.2 app:

Name: rails-html-sanitizer
Version: 1.3.0
Advisory: CVE-2015-7578
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI
Title: Possible XSS vulnerability in rails-html-sanitizer
Solution: upgrade to ~> 1.0.3

Name: rails-html-sanitizer
Version: 1.3.0
Advisory: CVE-2015-7580
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/uh--W4TDwmI
Title: Possible XSS vulnerability in rails-html-sanitizer
Solution: upgrade to ~> 1.0.3

Name: rails-html-sanitizer
Version: 1.3.0
Advisory: CVE-2015-7579
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/OU9ugTZcbjc
Title: XSS vulnerability in rails-html-sanitizer
Solution: upgrade to ~> 1.0.3

Vulnerabilities found!

[Rafael Mendonça França]

Yes, that is an error on bundle audit.

[Sean]

Am still getting the same error.