PT-2019-5086 · Ruby+2 · Loofah+2

Published 2019-10-22 · Updated 2026-03-13 · CVE-2019-15587

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Loofah gem for Ruby versions through 2.3.0

Description The issue is related to the Loofah gem for Ruby, where unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. This could potentially allow a remote attacker to impact data integrity by exploiting the vulnerability, which is associated with a lack of protection for the web page structure.

Recommendations For Loofah gem for Ruby versions through 2.3.0, consider disabling the use of crafted SVG elements in the sanitization process until a patch is available. Restrict access to the sanitization module to minimize the risk of exploitation. Avoid using the Loofah gem for Ruby for sensitive data processing until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2020-01752

CVE-2019-15587

DSA-4554-1

GHSA-C3GV-9CXF-6F57

OPENSUSE-SU-2022_3868-1

OPENSUSE-SU-2024:11337-1

OPENSUSE-SU-2024:11900-1

OPENSUSE-SU-2024:13162-1

OPENSUSE-SU-2024:14171-1

OPENSUSE-SU-2025:15120-1

OPENSUSE-SU-2026:10353-1

SUSE-SU-2022:3868-1

SUSE-SU-2022:4075-1

SUSE-SU-2022_3868-1

USN-4498-1

Affected Products

Loofah

Suse

Ubuntu

References · 45

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2019-15587.yml · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:13162-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10353-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15587 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11900-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20200429SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15587 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-15587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c3gv-9cxf-6f57 · Vendor Advisory
• https://debian.org/security/2019/dsa-4554 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01752 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14171-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XMCWPLYPNIWYAY443IZZJ4IHBBLIHBP5 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4WK2UG7ORKRQOJ6E4XJ2NVIHYJES6BYZ · Vendor Advisory