Skip to content
cve.newCreate a CVE report

loofah

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

medium5.3
GHSA-p9wj-w8xq-vjx6Package fixes recorded

Loofah allowed_uri? treats javascript&#x3a alert(1) as safe

Loofah::HTML5::Scrub.allowed_uri? returns true for a javascript: or vbscript: URI whose scheme is split by a numeric character reference without a trailing semicolon, followed by a character that allowed_uri? strips, such as a space or tab. A browser ends the reference at that character and reads javascript&#x3a alert(1) as javascript: alert(1).

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
loofah RubyGems
Affected range Recorded fix
From 2.25.0 before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-p9wj-w8xq-vjx6

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.25.0"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.25.0",
    "2.25.1",
    "2.25.2"
  ]
}
loofah RubyGems
Affected range Recorded fix
Earlier releases before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-345x-3rq2-jfrm

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.2.0",
    "0.2.1",
    "0.2.2",
    "0.3.0",
    "0.3.1",
    "0.4.0",
    "0.4.1",
    "0.4.2",
    "0.4.3",
    "0.4.4",
    "0.4.5",
    "0.4.6",
    "0.4.7",
    "1.0.0",
    "1.0.0.beta.1",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.3",
    "2.1.0",
    "2.1.0.rc1",
    "2.1.0.rc2",
    "2.1.1",
    "2.10.0",
    "2.11.0",
    "2.12.0",
    "2.13.0",
    "2.14.0",
    "2.15.0",
    "2.16.0",
    "2.17.0",
    "2.18.0",
    "2.19.0",
    "2.19.1",
    "2.2.0",
    "2.2.1",
    "2.2.2",
    "2.2.3",
    "2.20.0",
    "2.21.0",
    "2.21.0.rc1",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.21.4",
    "2.22.0",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.25.0",
    "2.25.1",
    "2.25.2",
    "2.3.0",
    "2.3.1",
    "2.4.0",
    "2.5.0",
    "2.6.0",
    "2.7.0",
    "2.8.0",
    "2.9.0",
    "2.9.1"
  ]
}
medium4.7
GHSA-m3x9-938q-5767Package fixes recorded

Loofah: CSS url() sanitization bypass via escaped parentheses

Loofah::HTML5::Scrub.scrub_css rejected any property whose top-level Crass tokens included a :url or :bad_url, and left url out of the allowed CSS functions. Both checks ran only against the first parse of the style attribute. When scrub_css rebuilt each property it emitted identifiers with their CSS escapes decoded, so parentheses written as escapes — url\28 …\29 — hid the url token from the checks, and the rebuilt value was re-parsed into a live url() that nothing checked again. An escaped property name, six-digit escapes, escaped comments and escaped quotes all reached the same place.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
loofah RubyGems
Affected range Recorded fix
Earlier releases before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-m3x9-938q-5767

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.2.0",
    "0.2.1",
    "0.2.2",
    "0.3.0",
    "0.3.1",
    "0.4.0",
    "0.4.1",
    "0.4.2",
    "0.4.3",
    "0.4.4",
    "0.4.5",
    "0.4.6",
    "0.4.7",
    "1.0.0",
    "1.0.0.beta.1",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.3",
    "2.1.0",
    "2.1.0.rc1",
    "2.1.0.rc2",
    "2.1.1",
    "2.10.0",
    "2.11.0",
    "2.12.0",
    "2.13.0",
    "2.14.0",
    "2.15.0",
    "2.16.0",
    "2.17.0",
    "2.18.0",
    "2.19.0",
    "2.19.1",
    "2.2.0",
    "2.2.1",
    "2.2.2",
    "2.2.3",
    "2.20.0",
    "2.21.0",
    "2.21.0.rc1",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.21.4",
    "2.22.0",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.25.0",
    "2.25.1",
    "2.25.2",
    "2.3.0",
    "2.3.1",
    "2.4.0",
    "2.5.0",
    "2.6.0",
    "2.7.0",
    "2.8.0",
    "2.9.0",
    "2.9.1"
  ]
}
medium5.3
GHSA-jcff-cj73-4w4fPackage fixes recorded

Loofah allowed_uri? treats data:text/html as safe text/plain

Loofah::HTML5::Scrub.allowed_uri? returns true for a data: URI whose mediatype is written with the HTML5 named character reference / in place of the solidus. Loofah reads that mediatype as malformed and falls back to the allowed text/plain, while a browser decodes the reference and reads the same URI as text/html.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
loofah RubyGems
Affected range Recorded fix
From 2.25.2 before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-jcff-cj73-4w4f

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.25.2"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.25.2"
  ]
}
medium5.3
GHSA-mf2j-8f84-cc9qPackage fixes recorded

Loofah: Regular expression denial of service in the SVG local-reference check

Loofah's HTML5 sanitizer restricts the href and xlink:href attributes of SVG reference elements to local references. That check matched the attribute value against /^\s*[^#\s].*/m. In Ruby ^ anchors to every line start and \s matches newlines, so an all-whitespace value made the engine rescan the value from each of its line starts, taking time quadratic in its length.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
loofah RubyGems
Affected range Recorded fix
Earlier releases before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-mf2j-8f84-cc9q

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "0.2.0",
    "0.2.1",
    "0.2.2",
    "0.3.0",
    "0.3.1",
    "0.4.0",
    "0.4.1",
    "0.4.2",
    "0.4.3",
    "0.4.4",
    "0.4.5",
    "0.4.6",
    "0.4.7",
    "1.0.0",
    "1.0.0.beta.1",
    "1.1.0",
    "1.2.0",
    "1.2.1",
    "2.0.0",
    "2.0.1",
    "2.0.2",
    "2.0.3",
    "2.1.0",
    "2.1.0.rc1",
    "2.1.0.rc2",
    "2.1.1",
    "2.10.0",
    "2.11.0",
    "2.12.0",
    "2.13.0",
    "2.14.0",
    "2.15.0",
    "2.16.0",
    "2.17.0",
    "2.18.0",
    "2.19.0",
    "2.19.1",
    "2.2.0",
    "2.2.1",
    "2.2.2",
    "2.2.3",
    "2.20.0",
    "2.21.0",
    "2.21.0.rc1",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.21.4",
    "2.22.0",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.25.0",
    "2.25.1",
    "2.25.2",
    "2.3.0",
    "2.3.1",
    "2.4.0",
    "2.5.0",
    "2.6.0",
    "2.7.0",
    "2.8.0",
    "2.9.0",
    "2.9.1"
  ]
}
medium6.1
CVE-2026-126203Package fixes recorded

Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values

Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.

Recorded fixes — loofah: 2.25.3. Check your release branch.

Exploitation not established

RubyGems / loofah
loofah RubyGems
Affected range Recorded fix
From 2.21.0 before 2.25.3Ecosystem versions2.25.3

Version evidence: OSV · GHSA-h6v6-rg66-fqj4

View original version evidence
{
  "ranges": [
    {
      "events": [
        {
          "introduced": "2.21.0"
        },
        {
          "fixed": "2.25.3"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "2.21.0",
    "2.21.1",
    "2.21.2",
    "2.21.3",
    "2.21.4",
    "2.22.0",
    "2.23.0",
    "2.23.1",
    "2.24.0",
    "2.24.1",
    "2.25.0",
    "2.25.1",
    "2.25.2"
  ]
}