medium5.4
CVE-2018-16468
Loofah Cross-site Scripting vulnerability
Impact
In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3. See https://github.com/flavorjones/loofah/issues/154 for more details.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| rubygems | loofah | < 2.2.3 | 2.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Loofah Project | Loofah | through 2.2.2 |
| Debian | Debian Linux | Version 9.0 |