Vulnerabilities

TI-2026-51604 CVE-2026-73492

Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

LOW 12

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-12 Partial fix · 2.25.2 CWE-184

TI-2026-51603 CVE-2026-73491 · GHSA-8whx-365g-h9vv

Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

LOW 12

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-08-12 Partial fix · 2.25.2 CWE-184

TI-2026-51602 CVE-2026-73490 · GHSA-9wjq-cp2p-hrgf

Loofah: SVG `href` attribute bypasses local-reference restriction

LOW 21

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00296 Published 2026-08-12 Partial fix · 2.25.2 CWE-79

TI-2022-07577 CVE-2022-23518 · GHSA-mcvf-2q2m-x72m

Improper neutralization of data URIs allows XSS in rails-html-sanitizer

LOW 29

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00925 Published 2022-12-14 Partial fix · 1.4.4 CWE-79

TI-2022-07575 CVE-2022-23516 · GHSA-3x8r-x6xp-q4vm

Uncontrolled Recursion in Loofah

MEDIUM 41

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01167 Published 2022-12-14 Partial fix · 2.19.1 CWE-674

TI-2022-07574 CVE-2022-23515 · GHSA-228g-948r-83gx

Improper neutralization of data URIs may allow XSS in Loofah

LOW 29

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00859 Published 2022-12-14 Partial fix · 2.19.1 CWE-79

TI-2022-07573 CVE-2022-23514 · GHSA-486f-hjj9-9vhh

Inefficient Regular Expression Complexity in Loofah

HIGH 72

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01829 Published 2022-12-14 Partial fix · 2.19.1 CWE-1333

TI-2019-11687 CVE-2019-15587 · GHSA-c3gv-9cxf-6f57

Cross-site scripting in Loofah

LOW 28

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01561 Published 2019-10-22 Partial fix · 2.3.1 CWE-79

TI-2018-11810 CVE-2018-16468 · GHSA-g4xq-jx4w-4cjv

Cross-site scripting in Loofah

LOW 26

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00916 Published 2018-10-30 Partial fix · 2.2.3 CWE-79

TI-2018-05825 CVE-2018-8048 · GHSA-x7rv-cr6v-4vm4

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in…

LOW 31

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01925 Published 2018-03-27 Fixed in 2.2.1, 1.8.3 CWE-79

Vulnerabilities

Filters