GMS-2022-8287: Duplicate of ./gem/loofah/CVE-2022-23515.yml
Summary
Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs.
Mitigation
Upgrade to Loofah >= 2.19.1.
Severity
The Loofah maintainers have evaluated this as [Medium Severity 6.1](https://www.first.org/cvss/calculator/3.0#.
References
- CWE - CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) (4.9)
- SVG MIME Type (image/svg+xml) is misleading to developers · Issue #266 · w3c/svgwg
- https://hackerone.com/reports/1694173
- https://github.com/flavorjones/loofah/issues/101
Credit
This vulnerability was responsibly reported by Maciej Piechota (@haqpl).
References
Detect and mitigate GMS-2022-8287 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →