https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-23518.htmlhttps://patchthecve.com/cve/CVE-2022-23518.htmlWed, 17 Jun 2026 04:30:17 +0000MEDIUM 6.1: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.https://patchthecve.com/cve/CVE-2022-23516.htmlhttps://patchthecve.com/cve/CVE-2022-23516.htmlWed, 17 Jun 2026 04:30:16 +0000HIGH 7.5: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a dehttps://patchthecve.com/cve/CVE-2022-23515.htmlhttps://patchthecve.com/cve/CVE-2022-23515.htmlWed, 17 Jun 2026 04:30:16 +0000MEDIUM 6.1: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerable to cross-site scripting via the image/svg+xml media type in data URIs. This issue is patched in version 2.19.1.https://patchthecve.com/cve/CVE-2022-23514.htmlhttps://patchthecve.com/cve/CVE-2022-23514.htmlWed, 17 Jun 2026 04:30:16 +0000HIGH 7.5: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a de