GitHub Advisoryadvisory · RubyGems

GHSA-g4xq-jx4w-4cjv Loofah Cross-site Scripting vulnerability

MEDIUM Published 2018-11-01 Modified 2023-01-23 Official page ↗
Aliases
CVE-2018-16468
Ecosystem
RubyGems
Packages
loofah
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• RubyGems loofah: < 2.2.3 → fixed in 2.2.3

Description

In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3. See https://github.com/flavorjones/loofah/issues/154 for more details.

Related

Alias · CVE (1)

  • CVE-2018-16468 In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References