[flavorjones]

Motivation

The nokogiri, loofah and rails-html-sanitizer maintainers published these GitHub security advisories on 2026-11-02 for vulnerabilities fixed in the releases below. None has been assigned a CVE yet, and none is in the GitHub Advisory Database yet.

• nokogiri 1.19.5
  • GHSA-3w22-6jfg-527w: use-after-free when replacing an attribute value
  • GHSA-4p39-36wj-23h4: possible mutation XSS when serializing noscript content in Nokogiri::HTML5 documents
  • GHSA-v995-44v6-5fqm: possible SSRF on JRuby when resolving external DTDs or entities with NONET set
• loofah 2.25.3
  • GHSA-345x-3rq2-jfrm: SVG <textPath> and <mpath> bypass the local-reference restriction
  • GHSA-h6v6-rg66-fqj4: mutation XSS in HTML5 scrubbers through unescaped attribute values
  • GHSA-jcff-cj73-4w4f: allowed_uri? treats data:text/html as safe text/plain
  • GHSA-m3x9-938q-5767: CSS url() sanitization bypass via escaped parentheses
  • GHSA-mf2j-8f84-cc9q: ReDoS in the SVG local-reference check
  • GHSA-p9wj-w8xq-vjx6: allowed_uri? treats javascript&#x3a alert(1) as safe
• rails-html-sanitizer 1.7.2
  • GHSA-cpgf-5mjf-73p7: possible ReDoS with certain configurations
  • GHSA-h7wh-q2qr-458c: possible XSS via shared scrubber state in concurrent calls

Details

I copied each file's title, description and CVSS score (where the GHSA has one) from its GHSA, and wrapped the description at 80 columns. patched_versions and unaffected_versions express the GHSA's affected range. GHSA-v995-44v6-5fqm.yml has platform: jruby, as GHSA-8678-w3jw-xfc2 does.