Advisory Package Curation

Cross-site Scripting in loofah Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected if running Loofah < 2.2.1, but only: * when running on MRI or RBX, * in combination with libxml2 >= 2.9.2. JRuby users are not affected.

XSS Vulnerability Loofah allows attributes that are not explicitly allowed to be present in sanitized output when input with specially-crafted HTML fragments.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') In the Loofah gem for Ruby, denylisted HTML attributes may occur in sanitized output by republishing a crafted HTML fragment.

Loofah XSS Vulnerability Loofah allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.

Revert libxml2 behavior in Nokogiri gem that could cause XSS [MRI] Behavior in libxml2 has been reverted which caused CVE-2018-8048 (loofah gem), CVE-2018-3740 (sanitize gem), and CVE-2018-3741 (rails-html-sanitizer gem). The commit in question is here: https://github.com/GNOME/libxml2/commit/960f0e2 and more information is available about this commit and its impact here: https://github.com/flavorjones/loofah/issues/144 This release simply reverts the libxml2 commit in question to protect users of Nokogiri's vendored libraries from similar vulnerabilities. If you're offended by what happened here, I'd kindly ask that you comment on the upstream bug report here: https://bugzilla.gnome.org/show_bug.cgi?id=769760