CVE catalog

CVE-2018-16468

ruby-loofah: CVE-2018-16468

[CVE catalog]

Severity
Medium · CVSS 6.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.92% · Oct 25, 2026

In the Loofah gem for Ruby, through v2.2.2, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianruby-loofahsid2.25.2-1fixed
Debianruby-loofahforky2.25.2-1fixed
Debianruby-loofahtrixie2.24.0-1fixed
Debianruby-loofahbookworm2.19.1-1fixed
Opensuserubygem-loofahtumbleweed2.23.1-1.5fixed
Opensuseruby3.2-rubygem-loofahtumbleweed2.19.1-1.2fixed
Opensuserubygem-loofahtumbleweed2.22.0-1.5fixed
Suserubygem-loofahlinux enterprise high availability extension 152.2.2-4.3.1fixed
Opensuserubygem-loofahtumbleweed2.14.0-1.1fixed
Suserubygem-loofahopenstack cloud 72.0.2-3.5.1fixed
Suserubygem-loofahopenstack cloud crowbar 82.0.2-3.5.1fixed
Suserubygem-loofahenterprise storage 42.0.2-3.5.1fixed
Opensuserubygem-loofahtumbleweed2.23.1-1.3fixed
Ubunturuby-loofah16.042.0.2-1vulnerable
Ubunturuby-loofah16.042.0.3-1vulnerable
Ubunturuby-loofah16.042.0.3-2vulnerable
Ubunturuby-loofah16.042.0.3-2+deb9u1build0.16.04.1vulnerable
Ubunturuby-loofah16.042.0.3-2+deb9u2build0.16.04.1fixed
Ubunturuby-loofah18.042.0.3-2vulnerable
Ubunturuby-loofah18.042.2.2-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianruby-loofahsourcesid2.2.3-1not yet assignedNot reported[912398]
Debianruby-loofahsourceforky2.2.3-1not yet assignedNot reported[912398]
Debianruby-loofahsourcetrixie2.2.3-1not yet assignedNot reported[912398]
Debianruby-loofahsourcebookworm2.2.3-1not yet assignedNot reported[912398]
Opensuserubygem-loofahrpmtumbleweed2.23.1-1.5Not reportedOPENSUSE-SU-2026:10353-1Not reported
Opensuseruby3.2-rubygem-loofahrpmtumbleweed2.19.1-1.2Not reportedOPENSUSE-SU-2024:13162-1Not reported
Opensuserubygem-loofahrpmtumbleweed2.22.0-1.5Not reportedOPENSUSE-SU-2024:14171-1Not reported
Suserubygem-loofahrpmlinux enterprise high availability extension 152.2.2-4.3.1Not reportedSUSE-SU-2018:3928-1Not reported
Opensuserubygem-loofahrpmtumbleweed2.14.0-1.1Not reportedOPENSUSE-SU-2024:11900-1Not reported
Suserubygem-loofahrpmopenstack cloud 72.0.2-3.5.1Not reportedSUSE-SU-2019:0394-1Not reported
Suserubygem-loofahrpmopenstack cloud crowbar 82.0.2-3.5.1Not reportedSUSE-SU-2019:0394-1Not reported
Suserubygem-loofahrpmenterprise storage 42.0.2-3.5.1Not reportedSUSE-SU-2019:0394-1Not reported
Opensuserubygem-loofahrpmtumbleweed2.23.1-1.3Not reportedOPENSUSE-SU-2025:15120-1Not reported
Ubunturuby-loofahdeb16.042.0.3-2+deb9u2build0.16.04.1Not reportedUBUNTU-CVE-2018-16468Not reported

[Debian bug #912398]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ruby4.0-rubygem-loofah]Unknown

    Source package: [rubygem-loofah]

    Details (1)

    • 2.25.0-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 2.14.0-1.1, 2.22.0-1.5, 2.23.1-1.3, 2.23.1-1.5

      Version impact unknown

      dsa · rubygem-loofah · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [ruby-loofah]Fixed
    Details (2)

    • 2.19.1-1 · all · bookworm

      Fixed · Fixed: 2.2.3-1

      dsa · ruby-loofah · debian · bookworm; dsa · ruby-loofah · debian · 12

    • 2.19.1-1 · all · bookworm

      Fixed · Fixed: 2.2.3-1

      dsa · ruby-loofah · debian · bookworm; dsa · ruby-loofah · debian · 12

[Debian 13 (Trixie)]

  • [ruby-loofah]Fixed
    Details (2)

    • 2.24.0-1 · all · trixie

      Fixed · Fixed: 2.2.3-1

      dsa · ruby-loofah · debian · 13

    • 2.24.0-1 · all · trixie

      Fixed · Fixed: 2.2.3-1

      dsa · ruby-loofah · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]