Improper neutralization of data URIs may allow XSS in Loofah

보통 6.1CVE-2022-23515 · GHSA-228g-948r-83gx · Published 14/12/2022 · updated 17/06/2026

요약

CVE-2022-23515은(는) loofah, loofah (loofah project)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.86%, 전체 취약점의 58.5%보다 높음.
조치: 2.19.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
loofah RubyGems	`≥ 2.1.0, < 2.19.1`	`2.19.1`
loofah loofah_project	`≥ 2.1.0, < 2.19.1`	`2.19.1`

Description

Summary

Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs.

Mitigation

Upgrade to Loofah >= 2.19.1.

Severity

The Loofah maintainers have evaluated this as Medium Severity 6.1.

References

Credit

This vulnerability was responsibly reported by Maciej Piechota (@haqpl).

NVD description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

References

flavorjones/loofah security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-23515 · ADVISORY
flavorjones/loofah · WEB
w3c/svgwg · WEB
flavorjones/loofah commit 415677f · WEB
hackerone.com/reports/1694173 · WEB
flavorjones/loofah · PACKAGE
rubysec/ruby-advisory-db · WEB
lists.debian.org/debian-lts-announce/2023/09/msg00011.html · WEB
lists.debian.org/debian-lts-announce/2024/09/msg00044.html · WEB

loofah의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free