PT-2022-16045 · Loofah+5 · Loofah+5

Haqpl · Published 2022-12-13 · Updated 2026-03-13 · CVE-2022-23515

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Loofah versions 2.1.0 through 2.19.0

Description The issue concerns a cross-site scripting vulnerability via the image/svg+xml media type in data URIs. This vulnerability affects Loofah, a library for manipulating and transforming HTML/XML documents and fragments built on top of Nokogiri.

Recommendations For Loofah versions 2.1.0 through 2.19.0, upgrade to version 2.19.1 to resolve the issue. As a temporary workaround, consider restricting the use of the image/svg+xml media type in data URIs until the patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-1338

ALT-PU-2023-4267

ALT-PU-2024-7813

CVE-2022-23515

DLA-3565-1

DLA-3901-1

GHSA-228G-948R-83GX

OPENSUSE-SU-2024:12768-1

OPENSUSE-SU-2024:14171-1

OPENSUSE-SU-2025:15120-1

OPENSUSE-SU-2026:10353-1

RHSA-2023:2097

RLSA-2023:2097

SUSE-SU-2023:1657-1

Affected Products

Alt Linux

Astra Linux

Loofah

Nokogiri

Rocky Linux

Suse

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23515.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/loofah/CVE-2022-23515.yml · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23515 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23515 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23515 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3565-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10353-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12768-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23515 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15120-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3901-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23515 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:1657-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23515 · Vendor Advisory