Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: >= 2.21.0, < 2.25.3
Patched in 2.25.3
Details
Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.
Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.
Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.
More rubygems advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.