CVE-2026-126203
Received Received - Intake

XSS Reparsing in Loofah via Nokogiri

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit sanitized output that a browser reparses as different markup when used with Nokogiri before 1.19.5, because those Nokogiri versions do not escape angle brackets in attribute values. MathML can place markup inside an allowed attribute so the reparsed output becomes live HTML. The :strip scrubber is affected in every browser, while :prune and :escape are affected in WebKit browsers. Loofah's HTML4 APIs, Loofah::Helpers.sanitize, :whitewash, rails-html-sanitizer's default configuration, and JRuby are not affected. This issue is fixed in version 2.25.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126203
EUVD
EUVD-2026-124615

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
flavorjones loofah From 2.21.0 (inc) to 2.25.2 (inc)
sparklemotion nokogiri 1.19.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a mutation-based cross-site scripting (XSS) issue in Loofah's HTML5 scrubbers. It occurs when Loofah versions 2.21.0 to 2.25.2 process untrusted HTML with Nokogiri before 1.19.5. The problem is that Nokogiri did not escape '<' and '>' in attribute values, allowing malicious MathML markup to be reinterpreted as executable HTML by browsers. This can lead to XSS attacks where attacker-controlled scripts execute in a user's browser.

Detection Guidance

Check Loofah version with gem list loofah. If between 2.21.0 and 2.25.2, it is vulnerable. Verify Nokogiri version with gem list nokogiri; versions below 1.19.5 are affected. Inspect applications using Loofah's HTML5 APIs like Loofah.html5_fragment or scrub_html5_* methods.

Impact Analysis

If you use Loofah's HTML5 APIs (like Loofah.html5_fragment) to sanitize untrusted HTML, your application could be vulnerable. Attackers could inject malicious scripts via crafted HTML that bypasses sanitization. This could lead to data theft, session hijacking, or defacement of your web application. The impact depends on the application's context and user privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. If exploited, it may result in data breaches, triggering mandatory breach notifications under GDPR Article 33 or HIPAA's Breach Notification Rule. Non-compliance could lead to fines or penalties.

Mitigation Strategies

Upgrade Loofah to 2.25.3 or later. Ensure Nokogiri is updated to 1.19.5 or higher. Review and update any code using Loofah's HTML5 APIs to confirm proper sanitization. Remove reliance on vulnerable scrubber methods like :strip, :prune, or :escape in WebKit browsers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126203. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...