Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| flavorjones | loofah | < 2.25.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-loofah | 2.25.2-1 | — |
| Debian 13 | ruby-loofah | No fix yet | — |
| Debian 12 | ruby-loofah | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-loofah | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 20.04 LTS | ruby-loofah | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ruby-loofah | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-loofah | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | SUSE-SU-2026:24250-1 |
| SLES 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | SUSE-SU-2026:24195-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hawk2 | 2.7.2+git.1792148770.648dcddb-1.1 | openSUSE-SU-2026:12153-1 |
| openSUSE Leap 16.0 | hawk2 | 2.7.2+git.1788518533.7d4dadd6-160000.1.1 | openSUSE-SU-2026:22068-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | ruby3.2-rails-8.1 | 8.1.3-r9 | — |
| Wolfi rolling | ruby3.4-rails-8.1 | 8.1.3-r11 | — |
| Wolfi rolling | ruby4.0-rails-8.1 | 8.1.3-r10 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | loofah | < 2.25.2 | 2.25.2 | GHSA-9wjq-cp2p-hrgf |
Advisories 4
- SUSE-SU-2026:24250-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24195-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 21, 2026
- openSUSE-SU-2026:22068-1 Security update for hawk2 SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:12153-1 hawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA media SUSE / openSUSE Security Updates · Oct 17, 2026