CVE-2022-23514: high-severity vulnerability in flavorjones loofah
Inefficient Regular Expression Complexity in Loofah
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 1.8%
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
flavorjones · loofahRelated CVEs — flavorjones loofah
In the same product, most dangerous first.
CVE-2022-23516HIGHUncontrolled Recursion in LoofahEPSS 1.2%CVE-2022-23515MEDIUMImproper neutralization of data URIs may allow XSS in LoofahEPSS 0.9%CVE-2026-73492LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolonsEPSS 0.4%CVE-2026-73491LOWLoofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character referencesEPSS 0.4%CVE-2026-73490MEDIUMLoofah: SVG `href` attribute bypasses local-reference restrictionEPSS 0.3%