Skip to content
OpenAdvisories

Package · RubyGems

loofah

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-73492

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semico…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Low 2.3
    CVE-2026-73491

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the H…

    flavorjones loofah ruby3.2-rails-8.1 ruby3.4-rails-8.1 Debian Ubuntu Wolfi RubyGems
  • Low —
    GHSA-2j22-pr5w-6gq8

    Loofah has improper detection of disallowed URIs via `allowed_uri?`

    ## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split by HTML entity-encoded control characters such as `
` (carriage return), `
` (line feed), or `	` (tab). ## Details The `allowed_uri…

    loofah RubyGems
  • Low —
    GHSA-46fp-8f5p-pf2m

    Improper detection of disallowed URIs by Loofah `allowed_uri?`

    ## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split by HTML entity-encoded control characters such as `
` (carriage return), `
` (line feed), or `	` (tab). ## Details The `allowed_uri…

    loofah RubyGems