Description
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-loofah | 2.2.1-1 | — |
| Debian 13 | ruby-loofah | 2.2.1-1 | — |
| Debian 12 | ruby-loofah | 2.2.1-1 | — |
| Debian 9 | ruby-loofah | 2.0.3-2+deb9u1 | DSA-4171-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | ansible-runner | 1.1.2-2.el7ar | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ansible-tower +5 | 3.3.3-1.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | bubblewrap | 0.1.7-1.el7 | RHSA-2019:0212 |
| Red Hat CloudForms 5 | cfme +5 | 5.10.0.33-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | dbus-api-service | 1.0.1-5.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | dumb-init | 1.2.0-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | erlang +50 | 19.3.6.7-1.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | google-config +1 | 2.0.0-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | httpd-configmap-generator | 0.2.2-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | nginx +8 | 1:1.10.2-1.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-infra +2 | 1.1.8-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-manageiq | 1.1.12-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-repositories +1 | 1.1.2-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-roles +1 | 1.1.5-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-shutdown-env | 1.0.0-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-v2v-conversion-host | 1.6.3-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ovirt-ansible-vm-infra | 1.1.10-1.el7ev | RHSA-2019:0212 |
| Red Hat CloudForms 5 | postgresql96 +9 | 9.6.10-1PGDG.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | prince | 9.0r2-10.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | pyOpenSSL +2 | 17.3.0-4.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-bambou +1 | 3.0.1-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-colorama | 0.3.7-2.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-crypto +1 | 2.6.1-16.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-daemon +1 | 2.1.2-7.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-funcsigs +1 | 1.0.2-1.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-future +1 | 0.16.0-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-lockfile +1 | 1:0.11.0-10.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-meld3 | 0.6.10-1.el7 | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-mock | 2.0.0-1.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-pbr +1 | 3.1.1-2.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-pexpect +1 | 4.6-1.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-psutil +1 | 5.4.3-2.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-ptyprocess +1 | 0.5.2-3.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-pylxca +1 | 2.1.1-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-pysocks | 1.5.6-3.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-requests +1 | 2.14.2-1.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-requests-toolbelt +1 | 0.8.0-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-tabulate +1 | 0.8.2-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-urllib3 +1 | 1.21.1-1.2.el7ost | RHSA-2019:0212 |
| Red Hat CloudForms 5 | python-vspk +1 | 5.3.2-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | qpid-proton +8 | 0.19.0-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rabbitmq-server | 3.7.4-1.el7at | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rh-postgresql95-postgresql-pglogical | 2.1.0-4.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rh-postgresql95-repmgr | 4.0.6-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | ruby +4 | 2.4.5-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-bcrypt +1 | 3.1.12-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-bigdecimal | 1.3.2-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-did_you_mean | 1.1.0-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-ffi +1 | 1.9.25-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-hamlit +1 | 2.8.8-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-http_parser.rb +1 | 0.6.0-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-io-console | 0.4.6-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-json +1 | 2.1.0-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-linux_block_device +1 | 0.2.1-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-memory_buffer +1 | 0.1.0-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-minitest | 5.10.1-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-net-telnet | 0.1.1-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-nio4r +1 | 2.3.1-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-nokogiri +1 | 1.8.2-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-openssl | 2.0.9-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-ovirt-engine-sdk4 +1 | 4.2.4-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-pg +1 | 0.18.4-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-power_assert | 0.4.1-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-psych | 2.2.2-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-puma +1 | 3.7.1-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-qpid_proton +1 | 0.22.0-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-rake | 12.0.0-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-rdoc | 5.0.0-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-redhat_access_cfme +1 | 2.0.3-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-redhat_access_lib | 1.1.4-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-rugged +1 | 0.27.4-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-sqlite3 +1 | 1.3.13-2.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-test-unit | 3.2.3-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-unf_ext +1 | 0.0.7.5-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-websocket-driver +1 | 0.6.5-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygem-xmlrpc | 0.2.1-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | rubygems +1 | 2.6.14.3-90.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | smem | 1.4-1.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | supervisor | 3.1.4-1.el7 | RHSA-2019:0212 |
| Red Hat CloudForms 5 | wmi | 1.3.14-7.el7cf | RHSA-2019:0212 |
| Red Hat CloudForms 5 | wxGTK3 +6 | 3.0.3-5.el7at | RHSA-2019:0212 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | rubygem-loofah | 2.0.2-3.8.1 | SUSE-SU-2022:4075-1, SUSE-SU-2019:2209-1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-loofah | 2.0.2-3.5.1 | SUSE-SU-2022:4075-1, SUSE-SU-2019:2209-1, SUSE-SU-2019:0394-1 |
| SUSE OpenStack Cloud 7 | rubygem-loofah | 2.0.2-3.5.1 | SUSE-SU-2019:2209-1, SUSE-SU-2019:0394-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Enterprise Storage 4 | rubygem-loofah | 2.0.2-3.5.1 | SUSE-SU-2019:2209-1, SUSE-SU-2019:0394-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-loofah | 2.19.1-1.2 | openSUSE-SU-2024:13162-1 |
| openSUSE Tumbleweed | ruby3.2-rubygem-nokogiri | 1.13.9-1.7 | openSUSE-SU-2024:13165-1 |
| openSUSE Tumbleweed | rubygem-loofah | 2.14.0-1.1 | openSUSE-SU-2026:10353-1, openSUSE-SU-2025:15120-1, openSUSE-SU-2024:14171-1 |
| openSUSE Tumbleweed | rubygem-nokogiri | 1.13.3-1.1 | openSUSE-SU-2026:10356-1, openSUSE-SU-2025:14697-1, openSUSE-SU-2024:14174-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | loofah | < 2.2.1 | 2.2.1 | GHSA-x7rv-cr6v-4vm4 |
| RubyGems | nokogiri | < 1.8.3 | 1.8.3 | GHSA-x7rv-cr6v-4vm4 |
Advisories 15
- RHSA-2019:0212 Red Hat Security Advisory: CloudForms 4.7 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- openSUSE-SU-2026:10353-1 ruby4.0-rubygem-loofah-2.23.1-1.5 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2026:10356-1 ruby4.0-rubygem-nokogiri-1.18.9-1.4 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- DSA-4171-1 ruby-loofah - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:13162-1 ruby3.2-rubygem-loofah-2.19.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:14697-1 ruby3.4-rubygem-nokogiri-1.18.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14171-1 ruby3.3-rubygem-loofah-2.22.0-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13165-1 ruby3.2-rubygem-nokogiri-1.13.9-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11900-1 ruby3.1-rubygem-loofah-2.14.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4075-1 Security update for rubygem-loofah SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14174-1 ruby3.3-rubygem-nokogiri-1.15.5-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11912-1 ruby3.1-rubygem-nokogiri-1.13.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0394-1 Security update for rubygem-loofah SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15120-1 ruby3.4-rubygem-loofah-2.23.1-1.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2209-1 Security update for rubygem-loofah SUSE / openSUSE Security Updates · Feb 4, 2026