Reflected cross-site scripting (XSS) In loofah
Description
Loofah Cross-site Scripting vulnerability In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.
See https://github.com/flavorjones/loofah/issues/154 for more details.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 2.2.3-1 | ||
debian 14 | 2.2.3-1 | ||
debian 12 | 2.2.3-1 | ||
 rubygems | 2.2.3 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2.