Loofah
Monthly
Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` directly with HTML-encoded strings, because the method fails to detect `javascript:` or `vbscript:` schemes disguised via semicolon-less numeric character references such as `:` (colon) or `	` (tab). This is a bypass of the prior fix in GHSA-46fp-8f5p-pf2m, which covered semicoloned references (`:`) but not the semicolon-less form that browsers still decode and execute. Loofah's default `sanitize()` path is not affected; only direct callers of the string-level `allowed_uri?` API - including Action Text 8.2's markdown link validation - are at risk. No public exploit identified at time of analysis; CVSS 4.0 scores this 2.3, reflecting narrow attack surface and high exploitation complexity.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` directly with HTML-encoded strings, because the method fails to detect `javascript:` or `vbscript:` schemes disguised via semicolon-less numeric character references such as `:` (colon) or `	` (tab). This is a bypass of the prior fix in GHSA-46fp-8f5p-pf2m, which covered semicoloned references (`:`) but not the semicolon-less form that browsers still decode and execute. Loofah's default `sanitize()` path is not affected; only direct callers of the string-level `allowed_uri?` API - including Action Text 8.2's markdown link validation - are at risk. No public exploit identified at time of analysis; CVSS 4.0 scores this 2.3, reflecting narrow attack surface and high exploitation complexity.
Cross-site scripting bypass in Loofah 2.25.0-2.25.1 allows attackers to smuggle `javascript:` URIs past the `allowed_uri?` helper by inserting HTML5 named whitespace character references (`	` or `
`) into the scheme. This is a partial bypass of the earlier fix for GHSA-46fp-8f5p-pf2m, which patched numeric character references but not named forms. Only callers that invoke `allowed_uri?` directly with HTML-encoded strings are vulnerable - including Action Text 8.2 markdown link validation - while Loofah's default `sanitize()` pipeline is explicitly unaffected. No public exploit identified at time of analysis; vendor-released patch in version 2.25.2.
SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.