GHSA-g4xq-jx4w-4cjv

Loofah Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-16468

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	loofah	< 2.2.3	2.2.3

Details

As written in the advisory (Markdown source, shown as plain text).

In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3. See https://github.com/flavorjones/loofah/issues/154 for more details.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-16468 advisory
https://github.com/flavorjones/loofah/issues/154 web
https://github.com/flavorjones/loofah package
https://www.debian.org/security/2019/dsa-4364 web