🔐 CVE Alert

CVE-2026-126206

UNKNOWN 0.0

Loofah allowed_uri? treats data:text/html as safe text/plain

CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.

CWE CWE-79 CWE-184
Vendor flavorjones
Product loofah
Published Nov 12, 2026
Stay Ahead of the Next One

Get instant alerts for flavorjones loofah

Be the first to know when new unknown vulnerabilities affecting flavorjones loofah are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

flavorjones / loofah
= 2.25.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/flavorjones/loofah/security/advisories/GHSA-jcff-cj73-4w4f github.com: https://github.com/flavorjones/loofah/pull/324 github.com: https://github.com/flavorjones/loofah/commit/ad92002966053309f83b550861e2ef04bc714744 github.com: https://github.com/flavorjones/loofah/releases/tag/v2.25.3