PT-2018-18405 · Rubinius+4 · Rbx+4

Published 2018-03-21 · Updated 2026-03-13 · CVE-2018-8048

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Loofah versions prior to 2.2.1

Description: The issue allows non-whitelisted HTML attributes to be present in sanitized output when input with specially-crafted HTML fragments. Users are affected when running on MRI or RBX, in combination with libxml2 >= 2.9.2. JRuby users are not affected.

Recommendations: For versions prior to 2.2.1, update to version 2.2.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of libxml2 to a version less than 2.9.2 when running on MRI or RBX, until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-8048

DSA-4171-1

GHSA-X7RV-CR6V-4VM4

OPENSUSE-SU-2024:11337-1

OPENSUSE-SU-2024:11340-1

OPENSUSE-SU-2024:11900-1

OPENSUSE-SU-2024:11912-1

OPENSUSE-SU-2024:13162-1

OPENSUSE-SU-2024:13165-1

OPENSUSE-SU-2024:14171-1

OPENSUSE-SU-2024:14174-1

OPENSUSE-SU-2025:14697-1

OPENSUSE-SU-2025:15120-1

OPENSUSE-SU-2026:10353-1

OPENSUSE-SU-2026:10356-1

RHSA-2019:0212

SUSE-SU-2019:0394-1

SUSE-SU-2019:2209-1

SUSE-SU-2022:4075-1

Affected Products

Jruby

Loofah

Mri

Rbx

Libxml2

References · 87

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-8048.yml · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2018-8048.yml · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:10353-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4171 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11912-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11900-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-8048 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14171-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8048 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2209-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15120-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-8048 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4171-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-8048 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14697-1 · Vendor Advisory