Skip to content
OpenAdvisories

Package · Debian

ruby-loofah

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Feed

  • Low 2.3
    CVE-2026-73492

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semico…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Low 2.3
    CVE-2026-73491

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the H…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 4.7
    CVE-2026-73490

    Loofah: SVG `href` attribute bypasses local-reference restriction

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-23516

    Uncontrolled Recursion in Loofah

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemSta…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-23515

    Improper neutralization of data URIs may allow XSS in Loofah

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in v…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-23514

    Inefficient Regular Expression Complexity in Loofah

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize cert…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2019-15587

    Loofah Allows Cross-site Scripting

    In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    loofah ruby-loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2018-16468

    Loofah Cross-site Scripting vulnerability

    In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    loofah ruby-loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2018-8048

    Cross-site Scripting in loofah

    In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

    nokogiri loofah ruby-loofah Debian RubyGems