From 3ed9bf62d0bb727852bf0b85917423a1fa093d42 Mon Sep 17 00:00:00 2001
From: Grey Baker <greysteil@gmail.com>
Date: Tue, 30 Oct 2018 15:32:47 +0000
Subject: [PATCH] Add CVE-2018-16468 for loofah (#363)

* Add CVE-2018-16468 for loofah
---
 gems/loofah/CVE-2018-16468.yaml | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 gems/loofah/CVE-2018-16468.yaml

diff --git a/gems/loofah/CVE-2018-16468.yaml b/gems/loofah/CVE-2018-16468.yaml
new file mode 100644
index 0000000000..94c7d82b1a
--- /dev/null
+++ b/gems/loofah/CVE-2018-16468.yaml
@@ -0,0 +1,16 @@
+---
+gem: loofah
+cve: 2018-16468
+url: https://github.com/flavorjones/loofah/issues/154
+title: Loofah XSS Vulnerability
+date: 2018-10-30
+description: |
+  In the Loofah gem, through v2.2.2, unsanitized JavaScript may occur in
+  sanitized output when a crafted SVG element is republished.
+
+cvss_v3: 6.4
+patched_versions:
+  - ">=  2.2.3"
+related:
+  url:
+    - https://hackerone.com/reports/429267