What’s Vulnerable › Vulnerabilities

CVE-2022-23515: Improper neutralization of data URIs may allow XSS in Loofah

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-12-14 · updated 2026-06-17
• Weakness: CWE-79

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

Affected products

• Debian Linux: 10.0
• flavorjones loofah: from 2.1.0 before 2.19.1 — fixed in 2.19.1
• Rubygems Loofah: from 2.1.0 before 2.19.1; 2.1.0, 2.1.1, 2.10.0, 2.11.0, 2.12.0, 2.13.0 (+19) — fixed in 2.19.1

How to fix

Upgrade to a fixed version: flavorjones loofah 2.19.1; Rubygems Loofah 2.19.1. Check the vendor advisory for mitigations.

References

• https://github.com/flavorjones/loofah/issues/101
• https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
• https://hackerone.com/reports/1694173
• https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
• https://github.com/flavorjones/loofah/issues/101
• https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
• https://hackerone.com/reports/1694173
• https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html

Get alerted when CVE-2022-23515 or the next vulnerability affects your stack