CVE-2026-126206
Received Received - Intake

XSS via Data URI in Loofah HTML Sanitizer

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed and falls back to the allowed text/plain, while a browser decodes the reference and interprets the same value as text/html. An application that validates a user-controlled URL with this helper and renders the approved value in href or another browser-interpreted URI attribute can allow cross-site scripting. Rails::HTML::Sanitizer.allowed_uri? re-exports the affected helper. Loofah's default sanitize() path is not affected because Nokogiri decodes the entity before URI validation. This issue is fixed in version 2.25.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126206
EUVD
EUVD-2026-124712

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
loofah loofah 2.25.3
loofah loofah to 2.25.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Loofah versions up to 2.25.2 incorrectly treated a data URI with a mediatype containing the HTML5 named character reference / as safe text/plain. This occurred because the allowed_uri? method decodes HTML entities but does not handle named references like /, allowing it to pass validation. While browsers decode / to a slash, making the URI effectively text/html, Loofah's fallback to text/plain created a discrepancy that could lead to cross-site scripting if the validated URL is rendered into an href or similar attribute.

Detection Guidance

Check if your system uses Loofah version 2.25.2 or earlier. Run: gem list loofah. If installed, verify if any application uses the affected allowed_uri? helper with user-controlled input.

Impact Analysis

This vulnerability allows an attacker to bypass URI validation by using a data URI with a malformed mediatype containing /. If an application uses the affected allowed_uri? helper and renders the validated URL in an href or similar attribute, the browser may interpret the URI as executable HTML/JavaScript, leading to cross-site scripting (XSS) attacks. This could allow attackers to execute arbitrary scripts in the context of the user's session.

Mitigation Strategies

Upgrade Loofah to version 2.25.3 or later. If upgrading is not possible, avoid using the allowed_uri? helper with user-controlled input until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126206. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...