Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: < 2.25.3
Patched in 2.25.3
Details
Loofah restricts href and xlink:href on certain SVG elements to same-document references. Two elements escaped the restriction:
<textPath>: SVG_ALLOW_LOCAL_HREF listed it in lowercase as textpath, but the HTML5 parser names the element textPath inside <svg>, so the check never matched on the HTML5 path.<mpath>: absent from SVG_ALLOW_LOCAL_HREF, so its references were never restricted on either path.rails-html-sanitizer reuses this safelist in its PermitScrubber, so it is affected too.
An external href or xlink:href on <textPath> or <mpath> survives sanitization. Firefox fetches the URL when rendering the content, which leaks the viewer's IP address, user agent, and referrer, and can reach hosts routable only from the viewer's network. Chrome and WebKit do not fetch external references on these elements. The impact is a network request to an attacker-chosen URL, not script execution.
Applications that sanitize user-supplied SVG, directly or inside HTML, with Loofah's default allowlist or with rails-html-sanitizer with SVG elements permitted are affected.
Upgrade to Loofah >= 2.25.3.
More rubygems advisories
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.