Vulnerability GHSA-h6v6-rg66-fqj4
Summary
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Details
Summary
Loofah's HTML5 scrubbers could emit output that a browser parses into different markup, allowing mutation XSS. Nokogiri < 1.19.5 did not escape < and > in attribute values. When the output contained certain MathML, a browser treated markup inside an allowed attribute as live HTML. The :strip scrubber is affected in every browser. The :prune and :escape scrubbers are affected in WebKit browsers such as Safari.
Nokogiri 1.19.5 escapes < and > in attribute values, as the HTML standard requires. Loofah 2.25.3 requires Nokogiri >= 1.19.5.
Impact
Applications that sanitize untrusted HTML with Loofah's HTML5 API (Loofah.html5_fragment, Loofah.html5_document and the scrub_html5_* methods) and display the result to other people are affected, including with the default allowlist.
Not affected: Loofah's HTML4 API (including Loofah::Helpers.sanitize), the :whitewash scrubber, rails-html-sanitizer's default configuration, and JRuby.
Mitigation
Upgrade to Loofah >= 2.25.3, or upgrade Nokogiri to >= 1.19.5.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
