Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: < 2.25.3
Patched in 2.25.3
Details
Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.
Only Ruby 3.1 and earlier are affected. Ruby 3.2 added linear-time regexp matching, which makes the pattern linear.
An attacker who supplies HTML to be sanitized can consume CPU out of proportion to the input size, by sending an SVG reference element whose href or xlink:href is a long run of whitespace.
The default safelist allows the elements in SVG_ALLOW_LOCAL_HREF, so no configuration change is required.
Upgrade to Loofah >= 2.25.3. Applications that cannot upgrade should run Ruby 3.2 or later, which matches the pattern in linear time.
Reported by scyoon through the Rails HackerOne program.
More rubygems advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.