Sanitize product description using rails default sanitizer

app/models/spree/product.rb

@@ -304,6 +304,16 @@ module Spree
       )
     end
 
+    # Remove any unsupported HTML.
+    def description
+      Rails::HTML::SafeListSanitizer.new.sanitize(super)
+    end
+
+    # # Remove any unsupported HTML.
+    def description=(html)
+      super(Rails::HTML::SafeListSanitizer.new.sanitize(html))
+    end
+
     private
 
     def update_units

spec/models/spree/product_spec.rb

@@ -748,6 +748,18 @@ module Spree
         expect(e.variants.reload).to be_empty
       end
     end
+
+    describe "serialisation" do
+      it "sanitises HTML in description" do
+        subject.description = "Hello <script>alert</script> dearest <b>monster</b>."
+        expect(subject.description).to eq "Hello alert dearest <b>monster</b>."
+      end
+
+      it "sanitises existing HTML in description" do
+        subject[:description] = "Hello <script>alert</script> dearest <b>monster</b>."
+        expect(subject.description).to eq "Hello alert dearest <b>monster</b>."
+      end
+    end
   end
 
   RSpec.describe "product import" do