CVE-2018-16468
Loofah Cross-site Scripting vulnerability
CVE-2018-16468 is a medium vulnerability (CVSS 5.4) in Loofah Project Loofah, published October 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.92%, the 60th percentile. Fixed in loofah 2.2.3.
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2018-16468- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2018-16468- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2018-0751 No score
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
EUVD-2018-0751- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g4xq-jx4w-4cjv
Loofah Cross-site Scripting vulnerability
In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.
See https://github.com/flavorjones/loofah/issues/154 for more details.
- Record
GHSA-g4xq-jx4w-4cjv- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2018-16468- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
DEBIAN-CVE-2018-16468- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 13 moreShow less
OSVGHSA-g4xq-jx4w-4cjv
Loofah Cross-site Scripting vulnerability
In the Loofah gem for Ruby, through version 2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. Users are advised to upgrade to version 2.2.3.
See https://github.com/flavorjones/loofah/issues/154 for more details.
- Record
GHSA-g4xq-jx4w-4cjv- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16468
In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
UBUNTU-CVE-2018-16468- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:0185-1 No score
Security update for rmt-server
This update for rmt-server to version 1.1.1 fixes the following issues:
The following issues have been fixed:
- Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579)
- Fixed listing of mirrored products (bsc#1102193)
- Include online migration paths into offline migration (bsc#1117106)
- Sync products that do not have a base product (bsc#1109307)
- Fixed SLP auto discovery for RMT (bsc#1113760)
Update dependencies for security fixes:
- CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)
- CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)
- CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:0185-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10589-1 No score
rmt-server-2.6.13-1.1 on GA media
These are all security issues fixed in the rmt-server-2.6.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10589-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11337-1 No score
ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-loofah-2.12.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11337-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11900-1 No score
ruby3.1-rubygem-loofah-2.14.0-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-loofah-2.14.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11900-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13162-1 No score
ruby3.2-rubygem-loofah-2.19.1-1.2 on GA media
These are all security issues fixed in the ruby3.2-rubygem-loofah-2.19.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13162-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14171-1 No score
ruby3.3-rubygem-loofah-2.22.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-loofah-2.22.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15120-1 No score
ruby3.4-rubygem-loofah-2.23.1-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-loofah-2.23.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15120-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10353-1 No score
ruby4.0-rubygem-loofah-2.23.1-1.5 on GA media
These are all security issues fixed in the ruby4.0-rubygem-loofah-2.23.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10353-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3928-1 No score
Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues:
Security issue fixed:
- CVE-2018-16468: Fixed XXS by removing the svg animate attribute
fromfrom the allowlist (bsc#1113969).
- Record
SUSE-SU-2018:3928-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0272-1 No score
Security update for rmt-server
This update for rmt-server to version 1.1.1 fixes the following issues:
The following issues have been fixed:
- Fixed migration problems which caused some extensions / modules to be dropped (bsc#1118584, bsc#1118579)
- Fixed listing of mirrored products (bsc#1102193)
- Include online migration paths into offline migration (bsc#1117106)
- Sync products that do not have a base product (bsc#1109307)
- Fixed SLP auto discovery for RMT (bsc#1113760)
Update dependencies for security fixes:
- CVE-2018-16468: Update loofah to 2.2.3 (bsc#1113969)
- CVE-2018-16470: Update rack to 2.0.6 (bsc#1114831)
- CVE-2018-14404: Update nokogiri to 1.8.5 (bsc#1102046)
- Record
SUSE-SU-2019:0272-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0394-1 No score
Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues:
Security issues fixed:
- CVE-2018-16468: Fixed XXS by removing the svg animate attribute
fromfrom the allowlist (bsc#1113969). - CVE-2018-8048: Fixed XSS vulnerability due to unescaped characters by libcxml2 (bsc#1085967).
- Record
SUSE-SU-2019:0394-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loofahRubyGems |
before 2.2.3 | 2.2.3 |
ruby-loofahDebian:12 |
before 2.2.3-1 | 2.2.3-1 |
ruby-loofahDebian:13 |
before 2.2.3-1 | 2.2.3-1 |
ruby-loofahDebian:14 |
before 2.2.3-1 | 2.2.3-1 |
ruby-loofahDebian:9 |
before 2.0.3-2+deb9u2, plus listed versions 2.0.3-22.0.3-2+deb9u1 |
2.0.3-2+deb9u2 |
loofahRubyGems |
before 2.2.3, plus listed versions 0.2.00.2.10.2.20.3.00.3.1 Show 24 moreShow less0.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.71.0.01.0.0.beta.11.1.01.2.01.2.12.0.02.0.12.0.22.0.32.1.02.1.0.rc12.1.0.rc22.1.12.2.02.2.12.2.2 |
2.2.3 |
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 |
before 2.2.2-4.3.1 | 2.2.2-4.3.1 |
rmt-serverSUSE:Linux Enterprise Module for Server Applications 15 |
before 1.1.1-3.13.1 | 1.1.1-3.13.1 |
rubygem-loofahSUSE:OpenStack Cloud 7 |
before 2.0.2-3.5.1 | 2.0.2-3.5.1 |
rubygem-loofahSUSE:OpenStack Cloud Crowbar 8 |
before 2.0.2-3.5.1 | 2.0.2-3.5.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-loofahSUSE:Enterprise Storage 4 |
before 2.0.2-3.5.1 | 2.0.2-3.5.1 |
ruby-loofahUbuntu:16.04:LTS |
before 2.0.3-2+deb9u2build0.16.04.1, plus listed versions 2.0.2-12.0.3-12.0.3-22.0.3-2+deb9u1build0.16.04.1 |
2.0.3-2+deb9u2build0.16.04.1 |
ruby-loofahUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.3-22.2.2-1 |
None known |
rmt-serveropenSUSE:Tumbleweed |
before 2.6.13-1.1 | 2.6.13-1.1 |
rubygem-loofahopenSUSE:Tumbleweed |
before 2.14.0-1.1 | 2.14.0-1.1 |
ruby3.2-rubygem-loofahopenSUSE:Tumbleweed |
before 2.19.1-1.2 | 2.19.1-1.2 |
rubygem-loofahopenSUSE:Tumbleweed |
before 2.22.0-1.5 | 2.22.0-1.5 |
rubygem-loofahopenSUSE:Tumbleweed |
before 2.23.1-1.3 | 2.23.1-1.3 |
rubygem-loofahopenSUSE:Tumbleweed |
before 2.23.1-1.5 | 2.23.1-1.5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2019/dsa-4364
github.com/flavorjones/loofah/issues/154
nvd.nist.gov/vuln/detail/CVE-2018-16468
security-tracker.debian.org/tracker/CVE-2018-16468
Show 38 moreShow less
suse.com/support/update/announcement/2018/suse-su-20183928-1
bugzilla.suse.com/1113969
ubuntu.com/security/CVE-2018-16468
cve.org/CVERecord?id=CVE-2018-16468
lists.opensuse.org/archives/list/[email protected]/thread/AV7P2XPVE2GW6NK2J7LPNFK4M3HRKL2B