It was discovered that ruby-sanitize, a whitelist-based HTML sanitizer, insufficiently sanitised <style> elements, which may result in cross-site scripting.