VYPR

Loofah

by flavorjones

gem: loofah

Source repositories

CVEs (6)

  • CVE-2022-23516HigDec 14, 2022
    risk 0.42cvss 7.5epss 0.01

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. …

  • CVE-2022-23514HigDec 14, 2022
    risk 0.42cvss 7.5epss 0.02

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes.…

  • CVE-2022-23515MedDec 14, 2022
    risk 0.33cvss 6.1epss 0.01

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

  • CVE-2026-73490MedAug 12, 2026
    risk 0.24cvss 4.7epss 0.00

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while…

  • CVE-2026-73492LowAug 12, 2026
    risk 0.08cvss —epss 0.00

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: or vbscript: URIs whose scheme is split by semicolon-less numeric…

  • CVE-2026-73491LowAug 12, 2026
    risk 0.08cvss —epss 0.00

    Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named…