| Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restrictionCVE-2026-126208 · GHSA-345X-3RQ2-JFRM |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah allowed_uri? treats javascript: alert(1) as safeCVE-2026-126209 · GHSA-P9WJ-W8XQ-VJX6 |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah: CSS url() sanitization bypass via escaped parenthesesCVE-2026-126207 · GHSA-M3X9-938Q-5767 |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah: Regular expression denial of service in the SVG local-reference checkCVE-2026-126205 · GHSA-MF2J-8F84-CC9Q |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah allowed_uri? treats data:text/html as safe text/plainCVE-2026-126206 · GHSA-JCFF-CJ73-4W4F |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute valuesCVE-2026-126203 · GHSA-H6V6-RG66-FQJ4 |
loofah |
RubyGems |
Medium
|
Fix reported |
|
| Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesCVE-2026-73491 · GHSA-8WHX-365G-H9VV |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel9 |
Red HatRubyGems |
Low
|
Fix reported |
|
| Loofah: SVG `href` attribute bypasses local-reference restrictionCVE-2026-73490 · GHSA-9WJQ-CP2P-HRGF |
Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel8Red Hat 3scale API Management Platform 2/3scale-amp2/system-rhel9 |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Loofah has improper detection of disallowed URIs via `allowed_uri?`GHSA-2J22-PR5W-6GQ8 |
loofah |
RubyGems |
Low
|
Fix reported |
|
| Improper detection of disallowed URIs by Loofah `allowed_uri?`GHSA-46FP-8F5P-PF2M |
loofah |
RubyGems |
Low
|
Fix reported |
|
| Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsGHSA-5QHF-9PHG-95M2 |
loofah |
RubyGems |
Low
|
Fix reported |
|
| Improper neutralization of data URIs may allow XSS in LoofahCVE-2022-23515 · GHSA-228G-948R-83GX |
Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel8Red Hat Satellite 6/tfm-ror51-rubygem-loofah |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Inefficient Regular Expression Complexity in LoofahCVE-2022-23514 · GHSA-486F-HJJ9-9VHH |
Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel8Red Hat Satellite 6/tfm-ror51-rubygem-loofah |
Red HatRubyGems |
High
|
Fix reported |
|
| Uncontrolled Recursion in LoofahCVE-2022-23516 · GHSA-3X8R-X6XP-Q4VM |
Red Hat 3scale API Management Platform 2/3scale-amp2/zync-rhel8Red Hat Satellite 6/satellite:el8/rubygem-loofah |
Red HatRubyGems |
High
|
Fix reported |
|
| Cross-site Scripting in loofahCVE-2018-8048 · GHSA-X7RV-CR6V-4VM4 |
loofahnokogiri |
RubyGems |
Medium
|
Fix reported |
|
| Loofah Allows Cross-site ScriptingCVE-2019-15587 · GHSA-C3GV-9CXF-6F57 |
CloudForms Management Engine 5/cfme-amazon-smartstateCloudForms Management Engine 5/cfme-gemset |
Red HatRubyGems |
Medium
|
Fix reported |
|
| Loofah Cross-site Scripting vulnerabilityCVE-2018-16468 · GHSA-G4XQ-JX4W-4CJV |
Red Hat Satellite 6/tfm-ror51-rubygem-loofahRed Hat Software Collections/rh-ror42-rubygem-loofah |
Red HatRubyGems |
Medium
|
Fix reported |
|
