Loofah HTML Sanitizer Vulnerability: SVG href Attribute Bypass
An early warning has been issued regarding a vulnerability in Loofah's HTML sanitizer where the SVG href attribute can bypass local-reference restrictions, potentially allowing the execution of dangerous content.
What happened
Reportedly, Loofah's HTML5 sanitizer did not properly restrict the href attribute on certain SVG elements, which could allow these elements to reference external documents. This could potentially lead to the execution of dangerous content if the referenced SVG contains scripts or other malicious content. The vulnerability appears to affect multiple versions of the Loofah gem, with fixes available in versions 2.19.1 and 2.25.2. It is under investigation whether this vulnerability has been exploited in the wild. Users of affected versions are advised to upgrade to Loofah >= 2.25.2 to mitigate potential risks.
How 0Day mitigates this
loofah is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.