How severe is xss via raw or html_safe on dynamic data?

Shield rates this high (CVSS 7.4), classified as CWE-79.

Rules / Ruby

SHIELD-RUBY-016

XSS via raw or html_safe on dynamic data

highRubyCWE-79CVSS 7.4

Marking interpolated or variable content as raw or html_safe outputs unescaped HTML, enabling XSS.

Let Rails auto-escape output or sanitize with the sanitize helper instead of raw or html_safe.

Vulnerable — Shield flags thisapp/helpers/comments_helper.rb

module CommentsHelper
  def formatted_comment(comment)
    raw(comment.body)
  end
end

Fixed — scans cleanapp/helpers/comments_helper.rb

module CommentsHelper
  def formatted_comment(comment)
    sanitize(comment.body, tags: %w[b i em strong a], attributes: %w[href])
  end
end

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-RUBY-016, the fixed one does not.