loofah (RubyGems)
Advisories
11
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2.25.2 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update loofah # Gemfile: gem "loofah", ">= 2.25.2"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-5qhf-9phg-95m2 Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons |
Low EPSS 0.39% |
>= 2.25.0, < 2.25.2 | 2.25.2 |
| GHSA-9wjq-cp2p-hrgf Loofah: SVG `href` attribute bypasses local-reference restriction |
Medium EPSS 0.30% |
< 2.25.2 | 2.25.2 |
| GHSA-8whx-365g-h9vv Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references |
Low EPSS 0.39% |
>= 2.25.0, < 2.25.2 | 2.25.2 |
| GHSA-2j22-pr5w-6gq8 Loofah has improper detection of disallowed URIs via `allowed_uri?` |
Low | >= 2.25.0, < 2.25.1 | 2.25.1 |
| GHSA-46fp-8f5p-pf2m Improper detection of disallowed URIs by Loofah `allowed_uri?` |
Low | >= 2.25.0, < 2.25.1 | 2.25.1 |
| GHSA-3x8r-x6xp-q4vm Uncontrolled Recursion in Loofah |
High EPSS 1.17% |
>= 2.2.0, < 2.19.1 | 2.19.1 |
| GHSA-228g-948r-83gx Improper neutralization of data URIs may allow XSS in Loofah |
Medium EPSS 0.86% |
>= 2.1.0, < 2.19.1 | 2.19.1 |
| GHSA-486f-hjj9-9vhh Inefficient Regular Expression Complexity in Loofah |
High EPSS 1.83% |
< 2.19.1 | 2.19.1 |
| GHSA-c3gv-9cxf-6f57 Loofah Allows Cross-site Scripting |
Medium EPSS 1.56% |
< 2.3.1 | 2.3.1 |
| GHSA-g4xq-jx4w-4cjv Loofah Cross-site Scripting vulnerability |
Medium EPSS 0.92% |
< 2.2.3 | 2.2.3 |
| GHSA-x7rv-cr6v-4vm4 Cross-site Scripting in loofah |
Medium EPSS 1.93% |
< 2.2.1 | 2.2.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor