| Package | Affected versions | Patched versions |
|---|---|---|
| loofah | < 2.2.1 | 2.2.1 |
| nokogiri | < 1.8.3 | 1.8.3 |
| loofah | < 2.2.1 | 2.2.1 |
Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.
Users are affected if running Loofah < 2.2.1, but only:
JRuby users are not affected.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free