CVE-2018-16468 describes a cross-site scripting (XSS) vulnerability in the Loofah gem for Ruby, affecting versions up to 2.2.2, where unsanitized JavaScript can be re-introduced into sanitized output via crafted SVG elements. This medium-severity vulnerability (CVSS 5.4) requires user interaction and network access, potentially leading to limited confidentiality and integrity impacts. While the vulnerability is present in Debian-based systems using Loofah, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.2.2CPE matchmatch criteria | cpe:2.3:a:loofah_project:loofah:*:*:*:*:*:ruby:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.