Skip to content
OpenAdvisories

Package · Ubuntu

ruby-loofah

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 2.3
    CVE-2026-73492

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semico…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems
  • Low 2.3
    CVE-2026-73491

    Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the H…

    flavorjones loofah loofah ruby-loofah Debian Ubuntu RubyGems