MEDIUM6.1RubyGems
GHSA-228g-948r-83gx· CVE-2022-23515Improper neutralization of data URIs may allow XSS in Loofah
Modified: 11/4/2025
package
RubyGems/loofah
pkg:rubygems/loofah
LOWRubyGems
GHSA-2j22-pr5w-6gq8Loofah has improper detection of disallowed URIs via `allowed_uri?`
Modified: 9/10/2026
HIGH7.5RubyGems
GHSA-3x8r-x6xp-q4vm· CVE-2022-23516Uncontrolled Recursion in Loofah
Modified: 11/4/2025
LOWRubyGems
GHSA-46fp-8f5p-pf2mImproper detection of disallowed URIs by Loofah `allowed_uri?`
Modified: 9/10/2026
HIGH7.5RubyGems
GHSA-486f-hjj9-9vhh· CVE-2022-23514Inefficient Regular Expression Complexity in Loofah
Modified: 11/4/2025
LOWRubyGems
GHSA-5qhf-9phg-95m2· CVE-2026-73492Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
Modified: 9/10/2026
LOWRubyGems
GHSA-8whx-365g-h9vv· CVE-2026-73491Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references
Modified: 9/10/2026
MEDIUM4.7RubyGems
GHSA-9wjq-cp2p-hrgf· CVE-2026-73490Loofah: SVG `href` attribute bypasses local-reference restriction
Modified: 9/10/2026
MEDIUM5.4RubyGems
GHSA-c3gv-9cxf-6f57· CVE-2019-15587Loofah Allows Cross-site Scripting
Modified: 2/16/2024
MEDIUM5.4RubyGems
GHSA-g4xq-jx4w-4cjv· CVE-2018-16468Loofah Cross-site Scripting vulnerability
Modified: 11/8/2023
MEDIUM6.1RubyGems
GHSA-x7rv-cr6v-4vm4· CVE-2018-8048Cross-site Scripting in loofah
Modified: 2/22/2024