CVE-2020-4054

In Sanitize (RubyGem sanitize) greater than or equal to 3.0.0 and less than 5.2.1, there is a cross-site scripting vulnerability. When HTML is sanitized using Sanitize's "relaxed" config, or a custom config that allows certain elements, some content in a math or svg element may not be sanitized correctly even if math and svg are not in the allowlist. You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements: iframe, math, noembed, noframes, noscript, plaintext, script, style, svg, xmp. Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser. This has been fixed in 5.2.1.

• CWE-79

• https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9Patch, Third Party Advisory
• https://github.com/rgrove/sanitize/releases/tag/v5.2.1Release Notes, Third Party Advisory
• https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8mThird Party Advisory
• https://usn.ubuntu.com/4543-1/
• https://www.debian.org/security/2020/dsa-4730
• https://github.com/rgrove/sanitize/commit/a11498de9e283cd457b35ee252983662f7452aa9Patch, Third Party Advisory
• https://github.com/rgrove/sanitize/releases/tag/v5.2.1Release Notes, Third Party Advisory
• https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8mThird Party Advisory
• https://usn.ubuntu.com/4543-1/
• https://www.debian.org/security/2020/dsa-4730

Published

Jun 16, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-4048In affected versions of WordPress, due to an issue in wp_val…5.7
• CVE-2020-4049In affected versions of WordPress, when uploading themes, th…2.4
• CVE-2020-4050In affected versions of WordPress, misuse of the `set-screen…3.1
• CVE-2020-4051In Dijit before versions 1.11.11, and greater than or equal …5.4
• CVE-2020-4052In Wiki.js before 2.4.107, there is a stored cross-site scri…6.1
• CVE-2020-4053In Helm greater than or equal to 3.0.0 and less than 3.2.4, …6.8
• CVE-2020-4059In mversion before 2.0.0, there is a command injection vulne…7.3
• CVE-2020-4060In LoRa Basics Station before 2.0.4, there is a Use After Fr…5
• CVE-2020-4061In October from version 1.0.319 and before version 1.0.467, …5.4
• CVE-2020-4062In Conjur OSS Helm Chart before 2.0.0, a recently identified…9
• CVE-2020-4066In Limdu before 0.95, the trainBatch function has a command …7.2
• CVE-2020-4067In coturn before version 4.5.1.3, there is an issue whereby …7.5