Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

loofah

9 known vulnerabilities (2 high, 2 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
9 · 2 high, 2 medium, 2 low
Registry
RubyGems

Advisories 9

  • Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons

    Affected: from 2.25.0, fixed in 2.25.2.

  • Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

    Affected: from 2.25.0, fixed in 2.25.2.

  • CVE-2026-73490Medium 4.7

    Loofah: SVG `href` attribute bypasses local-reference restriction

    Affected: fixed in 2.25.2.

  • Uncontrolled Recursion in Loofah

    Affected: from 2.2.0, fixed in 2.19.1.

  • CVE-2022-23515Medium 6.1

    Improper neutralization of data URIs may allow XSS in Loofah

    Affected: from 2.1.0, fixed in 2.19.1.

  • Inefficient Regular Expression Complexity in Loofah

    Affected: fixed in 2.19.1.

  • In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    Affected: fixed in 2.3.1.

  • In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

    Affected: fixed in 2.2.3.

  • In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML…

    Affected: fixed in 2.2.1.