CVE-2019-15587

Name of the Vulnerable Software and Affected Versions Loofah gem for Ruby versions through 2.3.0

Description The issue is related to the Loofah gem for Ruby, where unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished. This could potentially allow a remote attacker to impact data integrity by exploiting the vulnerability, which is associated with a lack of protection for the web page structure.

Recommendations For Loofah gem for Ruby versions through 2.3.0, consider disabling the use of crafted SVG elements in the sanitization process until a patch is available. Restrict access to the sanitization module to minimize the risk of exploitation. Avoid using the Loofah gem for Ruby for sensitive data processing until the issue is resolved.