Skip to content
OpenAdvisories

Package · Debian

ruby-loofah

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-73490

    Loofah: SVG `href` attribute bypasses local-reference restriction

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-23515

    Improper neutralization of data URIs may allow XSS in Loofah

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in v…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2019-15587

    Loofah Allows Cross-site Scripting

    In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    loofah ruby-loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 5.4
    CVE-2018-16468

    Loofah Cross-site Scripting vulnerability

    In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    loofah ruby-loofah ruby-loofah Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2018-8048

    Cross-site Scripting in loofah

    In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

    nokogiri loofah ruby-loofah Debian RubyGems