OtherCVSS 2.5€0
Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLs
smlee
Disclosed on HackerOne · April 18, 2026
Publicly disclosed report · by smlee
View original on HackerOneSummary
Rails::HTML::Sanitizer.allowed_uri? returns true for entity-encoded control-character-split javascript: URLs such as:
java script:alert(1)java script:alert(1)jav	ascript:alert(1)
When these values are rendered into href attributes, browsers normalize them to javascript: URLs and execute them on click.