Fluid Attacks Database

Description

Loofah Allows Cross-site Scripting In the Loofah gem for Ruby through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	ruby-loofah	>=0 <2.3.1+dfsg-1	2.3.1+dfsg-1
rubygems	loofah	>=0 <2.3.1	2.3.1
debian 12	ruby-loofah	>=0 <2.3.1+dfsg-1	2.3.1+dfsg-1
debian 13	ruby-loofah	>=0 <2.3.1+dfsg-1	2.3.1+dfsg-1

Aliases

1. CVE-2019-155872. NVD-2019-155873. OSV-DEBIAN-2019-155874. OSV-2019-155875. GCVE-2019-155876. SECURITY-TRACKER-CVE-2019-15587

References

1. https://github.com/flavorjones/loofah/issues/1712. https://github.com/flavorjones/loofah/commit/0c6617af440879ce97440f6eb6c58636456dc8ec3. https://hackerone.com/reports/7090094. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2019-15587.yml5. https://lists.fedoraproject.org/archives/list/[email protected]/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ6. https://lists.fedoraproject.org/archives/list/[email protected]/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP57. https://security.netapp.com/advisory/ntap-20191122-00038. https://usn.ubuntu.com/4498-19. https://www.debian.org/security/2019/dsa-4554

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.