CVE-2019-15587

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In the Loofah gem for Ruby through v2.3.0 unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Loofah (rubygem)	Fixed in v2.3.1

References

https://github.com/flavorjones/loofah/issues/171Third Party Advisory
https://hackerone.com/reports/709009Permissions Required, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5/
https://security.netapp.com/advisory/ntap-20191122-0003/Third Party Advisory
https://usn.ubuntu.com/4498-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4554Third Party Advisory
https://github.com/flavorjones/loofah/issues/171Third Party Advisory
https://hackerone.com/reports/709009Permissions Required, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5/
https://security.netapp.com/advisory/ntap-20191122-0003/Third Party Advisory
https://usn.ubuntu.com/4498-1/Third Party Advisory
https://www.debian.org/security/2019/dsa-4554Third Party Advisory

Timeline

Published: Oct 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-155887.2There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Ex CVE-2019-155898.8An improper access control vulnerability exists in Gitlab <v12.3.2, <v12.2.6, <v12.1.12 which would allow a blocked user would be able to us CVE-2019-15595.9If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive on CVE-2019-155907.5An access control issue exists in < 12.3.5, < 12.2.8, and < 12.1.14 for GitLab Community Edition (CE) and Enterprise Edition (EE) where priv CVE-2019-155916.5An improper access control vulnerability exists in GitLab <12.3.3 that allows an attacker to obtain container and dependency scanning report CVE-2019-155924.3GitLab 12.2.2 and below contains a security vulnerability that allows a guest user in a private project to see the merge request ID associat CVE-2019-155936.5GitLab 12.2.3 contains a security vulnerability that allows a user to affect the availability of the service through a Denial of Service att CVE-2019-155944.3GitLab 11.8 and later contains a security vulnerability that allows a user to obtain details of restricted pipelines via the merge request e CVE-2019-155958.8A privilege escalation exists in UniFi Video Controller =<3.10.6 that would allow an attacker on the local machine to run arbitrary commands CVE-2019-155967.5A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within t CVE-2019-155979.8A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.CVE-2019-155989.8A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the c