Most recent entries from all

BREW-mikutter-CVE-2018-8048 — Cross-site Scripting in loofah

2026-10-03T19:32:50.204681+00:00

Affected: Homebrew: mikutter

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX, * in combination with libxml2 >= 2.9.2.

JRuby users are not affected.

cnvd-2018-07649

2026-10-03T19:32:50.204746+00:00

cnvd-2018-07649

EUVD-2026-63549

2026-10-03T19:32:50.204763+00:00

EUVD-2026-63549

fkie_cve-2018-8048

2026-10-03T19:32:50.204775+00:00

In the Loofah gem through 2.2.0 for Ruby, non-whitelisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

GHSA-x7rv-cr6v-4vm4 — Cross-site Scripting in loofah

2026-10-03T19:32:50.204796+00:00

Affected: RubyGems: loofah, RubyGems: nokogiri

Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Users are affected if running Loofah < 2.2.1, but only:

* when running on MRI or RBX, * in combination with libxml2 >= 2.9.2.

JRuby users are not affected.

gsd-2018-8048

2026-10-03T19:32:50.204821+00:00

gsd-2018-8048

openSUSE-SU-2024:11337-1 — ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media

2026-10-03T19:32:50.204831+00:00

ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media

RHSA-2019:0212 — Red Hat Security Advisory: CloudForms 4.7 security, bug fix and enhancement update

2026-10-03T19:32:50.204849+00:00

rubygem-nokogiri: XML eXternal Entity (XXE) flaw rubygem-rails-html-sanitizer: non-whitelisted attributes are present in sanitized output when input with specially-crafted HTML fragments leading to XSS vulnerability rubygem-loofah: XSS vulnerability due to unescaped comments within attributes by libxml2 rubygem-sinatra: XSS in the 400 Bad Request page

SUSE-SU-2019:0394-1 — Security update for rubygem-loofah

2026-10-03T19:32:50.204870+00:00

Security update for rubygem-loofah