CVE-2026-126207
Received Received - Intake

Cross-Site Scripting via CSS in Loofah

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: GitHub, Inc.

Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escapes decoded so escaped parentheses, property names, comments, or quotes can become a live url() without a second safety check. An attacker can use list-style to make a viewer's browser request an attacker-chosen URL when content renders, or cursor to make the request on hover. The request can disclose the viewer's IP address, user agent, access timing, and access to internal-network hosts, but no script survives sanitization and the attacker cannot read the response. This issue is fixed in version 2.25.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-126207
EUVD
EUVD-2026-124713

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
loofah loofah 2.25.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-180 The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Loofah versions before 2.25.3 have a flaw in CSS sanitization where escaped characters in style attributes bypass security checks. The scrub_css function only checks the first parse of a style attribute, then rebuilds CSS with decoded escape sequences like parentheses or quotes. This allows attackers to hide malicious url() functions in CSS properties such as list-style or cursor, causing browsers to make unintended requests to attacker-controlled URLs. The requests may leak the victim's IP address, user agent, or access timing, but no malicious scripts execute.

Detection Guidance

To detect this vulnerability, check the installed version of the Loofah gem using the command: gem list loofah. If the version is below 2.25.3, the system is vulnerable. Additionally, inspect application logs for style attributes containing escaped characters like url\28 or list-style properties that may trigger external requests.

Impact Analysis

If you use an affected Loofah version to sanitize user-supplied HTML/CSS, attackers could trick your application into making requests to their servers when users view sanitized content. This could expose user IP addresses, browser details, or internal network hosts. The impact is limited to information leakage; no direct code execution or data theft occurs.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if user data (e.g., IP addresses) is inadvertently exposed through attacker-controlled requests. GDPR requires protecting personal data, and HIPAA mandates safeguarding sensitive health information. The leakage of such data due to this flaw may violate these regulations.

Mitigation Strategies

Immediately upgrade the Loofah gem to version 2.25.3 or later using the command: gem update loofah. If upgrading is not possible, apply input validation to sanitize CSS properties before processing with Loofah. Review and restrict outbound network requests from applications using Loofah to limit potential data leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...