Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 30 Oct 2018 09:14:52 -0400
From: Mike Dalessio <>
Subject: [CVE-2018-16468] Loofah XSS Vulnerability

Hello all,

A *medium* severity vulnerability has been identified and patched in Loofah
v2.2.3, which is a dependency of `rails-html-sanitizer`. This issue has
been assigned CVE-2018-16468.

The public notice can be found here:

To save you a click, I've reproduced the contents of the announcement here.


*# CVE-2018-16468 - Loofah XSS Vulnerability*

This issue has been created for public disclosure of an XSS vulnerability
that was responsibly reported (independently) by [Shubham Pathak]( and @yasinS (Yasin Soliman).

I'd like to thank [HackerOne]( for providing a
secure, responsible mechanism for reporting, and for providing their
fantastic service to the Loofah maintainers.

*## Severity*

Loofah maintainers have evaluated this as [Medium (CVSS3 6.4)](

*## Description*

In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.

*## Affected Versions*

Loofah < v2.2.3.

*## Mitigation*

Upgrade to Loofah v2.2.3.

*## References*

* [HackerOne report](

*## History of this public disclosure*

2018-10-27: disclosure created, all information is embargoed
2018-10-30: embargo ends, full information made available

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.