It was discovered that Loofah does not properly sanitize JavaScript in sanitized output. An attacker could possibly use this issue to perform XSS attacks. (CVE-2019-15587)
{ "availability": "No subscription required", "binaries": [ { "ruby-loofah": "2.0.3-2+deb9u3build0.16.04.1" } ] }