Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 22 Oct 2019 09:15:06 -0400
From: Mike Dalessio <>
Subject: [CVE-2019-15587] Loofah XSS Vulnerability

Hello all,

A *medium* severity vulnerability has been identified and patched in Loofah
v2.3.1, which is a dependency of `rails-html-sanitizer`. This issue has
been assigned CVE-2019-15587.

The public notice can be found here:

To save you a click, I've reproduced the contents of the announcement here.


*# CVE-2019-15587 - Loofah XSS Vulnerability*
This issue has been created for public disclosure of an XSS vulnerability
that was responsibly reported by

I'd like to thank [HackerOne]( for providing a
secure, responsible mechanism for reporting, and for providing their
fantastic service to the Loofah maintainers.

*## Severity*
Loofah maintainers have evaluated this as [Medium (CVSS3 6.4)](

*## Description*
In the Loofah gem, through v2.3.0, unsanitized JavaScript may occur in
sanitized output when a crafted SVG element is republished.

*## Affected Versions*
Loofah < v2.3.0

*## Mitigation*
Upgrade to Loofah v2.3.1 or later.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.