CVE-2019-15587
Loofah Allows Cross-site Scripting
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2019-15587- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2019-15587- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2019-0741 No score
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
EUVD-2019-0741- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c3gv-9cxf-6f57
Loofah Allows Cross-site Scripting
In the Loofah gem for Ruby through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
GHSA-c3gv-9cxf-6f57- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
CVE-2019-15587- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-15587
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
DEBIAN-CVE-2019-15587- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 11 moreShow less
OSVGHSA-c3gv-9cxf-6f57
Loofah Allows Cross-site Scripting
In the Loofah gem for Ruby through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
GHSA-c3gv-9cxf-6f57- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-15587
In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
- Record
UBUNTU-CVE-2019-15587- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11337-1 No score
ruby2.7-rubygem-loofah-2.12.0-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-loofah-2.12.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11337-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11900-1 No score
ruby3.1-rubygem-loofah-2.14.0-1.1 on GA media
These are all security issues fixed in the ruby3.1-rubygem-loofah-2.14.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11900-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13162-1 No score
ruby3.2-rubygem-loofah-2.19.1-1.2 on GA media
These are all security issues fixed in the ruby3.2-rubygem-loofah-2.19.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13162-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14171-1 No score
ruby3.3-rubygem-loofah-2.22.0-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-loofah-2.22.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14171-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15120-1 No score
ruby3.4-rubygem-loofah-2.23.1-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-loofah-2.23.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15120-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10353-1 No score
ruby4.0-rubygem-loofah-2.23.1-1.5 on GA media
These are all security issues fixed in the ruby4.0-rubygem-loofah-2.23.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10353-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:3868-1 No score
Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues:
- CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements (bsc#1154751).
- Record
SUSE-SU-2022:3868-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:4075-1 No score
Security update for rubygem-loofah
This update for rubygem-loofah fixes the following issues:
- CVE-2019-15587: Fixed issue in sanitization of crafted SVG elements (bsc#1154751).
- Record
SUSE-SU-2022:4075-1- Updated
- 2026-11-02
OSVUSN-4498-1 No score
ruby-loofah vulnerability
It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. (CVE-2019-15587)
- Record
USN-4498-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
loofahRubyGems |
before 2.3.1 | 2.3.1 |
ruby-loofahDebian:12 |
before 2.3.1+dfsg-1 | 2.3.1+dfsg-1 |
ruby-loofahDebian:13 |
before 2.3.1+dfsg-1 | 2.3.1+dfsg-1 |
ruby-loofahDebian:14 |
before 2.3.1+dfsg-1 | 2.3.1+dfsg-1 |
ruby-loofahDebian:9 |
before 2.0.3-2+deb9u3, plus listed versions 2.0.3-22.0.3-2+deb9u12.0.3-2+deb9u2 |
2.0.3-2+deb9u3 |
ruby-loofahDebian:10 |
before 2.2.3-1+deb10u1, plus listed versions 2.2.3-1 |
2.2.3-1+deb10u1 |
loofahRubyGems |
before 2.3.1, plus listed versions 0.2.00.2.10.2.20.3.00.3.1 Show 26 moreShow less0.4.00.4.10.4.20.4.30.4.40.4.50.4.60.4.71.0.01.0.0.beta.11.1.01.2.01.2.12.0.02.0.12.0.22.0.32.1.02.1.0.rc12.1.0.rc22.1.12.2.02.2.12.2.22.2.32.3.0 |
2.3.1 |
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 SP1 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 SP2 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 SP3 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahSUSE:Linux Enterprise High Availability Extension 15 SP4 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahopenSUSE:Leap 15.3 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahopenSUSE:Leap 15.4 |
before 2.2.2-150000.4.6.1 | 2.2.2-150000.4.6.1 |
rubygem-loofahSUSE:OpenStack Cloud Crowbar 8 From an advisory covering 2 CVEs |
before 2.0.2-3.11.1 | 2.0.2-3.11.1 |
rubygem-loofahSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs |
before 2.0.2-3.11.1 | 2.0.2-3.11.1 |
ruby-loofahUbuntu:16.04:LTS |
before 2.0.3-2+deb9u3build0.16.04.1, plus listed versions 2.0.2-12.0.3-12.0.3-22.0.3-2+deb9u1build0.16.04.12.0.3-2+deb9u2build0.16.04.1 |
2.0.3-2+deb9u3build0.16.04.1 |
ruby-loofahUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.3-22.2.2-1 |
None known |
rubygem-loofahopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.14.0-1.1 | 2.14.0-1.1 |
ruby3.2-rubygem-loofahopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.19.1-1.2 | 2.19.1-1.2 |
rubygem-loofahopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.22.0-1.5 | 2.22.0-1.5 |
rubygem-loofahopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.23.1-1.3 | 2.23.1-1.3 |
rubygem-loofahopenSUSE:Tumbleweed From an advisory covering 6 CVEs |
before 2.23.1-1.5 | 2.23.1-1.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-15587 is a medium vulnerability (CVSS 5.4) in Loofah Project Loofah, published October 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.56%, the 75th percentile. Fixed in loofah 2.3.1.
References
hackerone.com/reports/709009
github.com/flavorjones/loofah/issues/171
debian.org/security/2019/dsa-4554
security.netapp.com/advisory/ntap-20191122-0003
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ
Show 22 moreShow less
usn.ubuntu.com/4498-1
nvd.nist.gov/vuln/detail/CVE-2019-15587
security-tracker.debian.org/tracker/CVE-2019-15587
suse.com/support/update/announcement/2022/suse-su-20223868-1
bugzilla.suse.com/1154751
ubuntu.com/security/CVE-2019-15587
cve.org/CVERecord?id=CVE-2019-15587
lists.opensuse.org/archives/list/[email protected]/thread/4IMNBB7ILYWTPHGNZ6BMSJ6C3YZLGIWO