CVE-2022-23515

Improper neutralization of data URIs may allow XSS in Loofah

State: Published
Severity: 6.1 Medium
Published: Dec 14, 2022
Updated: Nov 3, 2025
Reserved: Jan 19, 2022

Description

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
loofahflavorjones	>= 2.1.0, < 2.19.1Affected

References

https://github.com/flavorjones/loofah/security/advisories/GHSA-228g-948r-83gx
https://github.com/flavorjones/loofah/issues/101
https://hackerone.com/reports/1694173
https://lists.debian.org/debian-lts-announce/2023/09/msg00011.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00044.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.